CVE-2024-42210 - CVE House
Back to Database
Status published High CVE-2024-42210

HCL Unica Marketing Operations v12.1.8 and lower is affected by a Stored cross-site scripting (XSS) vulnerability

Vulnerability Description

A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower.  Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its later HTTP responses in an unsafe way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-42210

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Mario Tesoro

References

More from HCLSoftware

View All →
CVE-2025-62338
HCL BigFix Cloud Lifecycle Management is affected by lack of input validation
Low 3.3
CVE-2025-62328
HCL Nomad server on Domino is affected by a missing default frame-ancestors directive
Low 3.7
CVE-2025-62327
HCL DevOps Deploy is susceptible to insufficiently protected credentials
Medium 4.9
CVE-2025-62326
HCL Digital Experience is susceptible to stored cross-site scripting (XSS)
Medium 6.1
CVE-2025-59868
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure
Medium 5.5

Affected Vendor

HCLSoftware

View all reports →

Affected Software

Unica Marketing Operations (Plan)
Vulnerable Versions:
<= 12.1.8

Timeline

Official Publish: March 19th, 2026
Last Modified: March 23rd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact