Security on

HCL Connections is vulnerable for CVE-2025-54988

christoph.stoettner@stoeps.de (Christoph Stoettner) — Fri, 26 Sep 2025 18:00:00 +0200

HCL published the Security Bulletin: HCL Connections is affected by an XML External Entity (XXE) vulnerability in Apache Tika (CVE-2025-54988) that Connections is also vulnerable for CVE-2025-54988!

Troubleshooting IBM WebSphere LDAP Security

christoph.stoettner@stoeps.de (Christoph Stoettner) — Wed, 09 Apr 2025 21:00:00 +0200

Most of the LDAP connections from IBM WebSphere Application Server are configured with TLS. So you need to have the root certificate in the WebSphere truststore to connect.

CVE-2024-23557 - HCL Connections Security Update for User Enumeration Vulnerability

christoph.stoettner@stoeps.de (Christoph Stoettner) — Sun, 21 Apr 2024 17:30:00 +0200

Some time back, I stumbled upon a flaw in HCL Connections 7 and 8 that allowed for user enumeration. This flaw could be exploited by anonymous users.

Update Elasticsearch certificates in Componentpack

christoph.stoettner@stoeps.de (Christoph Stoettner) — Fri, 02 Sep 2022 13:00:00 +0200

Elasticsearch in HCL Connections Componentpack is secured with Searchguard and needs certificates to work properly. These certificates are generated by bootstrap during the initial container deployment with helm.

These certificates are valid for 10 years (chain_ca.pem) or 2 years (elasticsearch*.pem) and stored in the Kubernetes secrets elasticsearch-secret, elasticsearch-7-secret. So when your HCL Connections deployment is running for 2 years, the certficates stop working.

Videostreaming in HCL Connections

christoph.stoettner@stoeps.de (Christoph Stoettner) — Mon, 07 Mar 2022 14:50:00 +0100

In late 2021 I had an HCL Connections environment starting swapping, because the AppCluster used more than 30 GB of memory.

The system has

two nodes
is installed with the medium-sized deployment option
About 7500 users with a high adoption rate, because Connections is also used as intranet