CVE-2024-30152 is a medium severity (CVSS 6.5) vulnerability in HCL SX v21. The product uses a weak cryptographic algorithm, which an attacker could exploit to read sensitive information or modify data. The record gives no fixed version, so read HCL's knowledge base article KB0120735 and apply the update it names.
What's affected
The NVD record names HCL SX v21 as the affected product. It does not list version numbers or fixed versions.
HCL publishes the details in knowledge base article KB0120735. When I fetched that page, it rendered only a loading message, so I could not read the affected and fixed versions. Open the article in a browser with your HCL support login if needed, and take the version list from there.
The product name in the record is HCL SX, version 21.
How to check if you're exposed
Find out whether you run HCL SX v21 at all. Ask the team that owns collaboration, analytics or cloud tools, because these products are often installed by a business unit.
Then read the version from the product's about or admin page, and compare it with the affected and fixed versions in article KB0120735.
If the article is hard to reach, open a case with HCL support and ask for the fixed version in writing.
What to do now
- Read HCL article KB0120735 and write down the affected and fixed versions.
- Update to the fixed version the article names.
- Ask HCL which algorithm the article refers to and where the product uses it.
- Re-encrypt or re-sign data that was protected with the weak algorithm once the fix is in place, if the article says to.
- Review other products for retired algorithms such as SHA1, MD5, DES and RC4, and set a minimum in your standards.
Why it matters
The class is CWE-327, use of a broken or risky cryptographic algorithm. Cryptography only protects data while the algorithm resists attack. Older algorithms and short keys get cheaper to break as computers improve, and standards bodies retire them over time.
The record does not name the algorithm, so I will not guess it. The vector needs user interaction and rates the integrity impact as high, which fits the NVD text about modifying data. Treat the fix as a configuration and version change, and then check what else in your estate still negotiates old algorithms.
A note on vendor articles. Some support portals load their content with scripts, so a plain page fetch or a text-only reader shows nothing. If you track advisories with an automated tool, check that it can read the articles you depend on, or you may miss the fixed version. Keep a record of the article number, the date you read it and the version you chose, so the audit trail is clear if someone asks later.
Quick check
Does the CVE name the weak algorithm?
No. The NVD text says only a weak cryptographic algorithm. The HCL article is the place to look for detail.
Sources
Last reviewed: 19 October 2026.
