HCL Unica Platform CVE-2025-31969

Exploitation requires the HCL Unica Platform to be serving responses with the misconfigured/overly permissive Content Security Policy headers (the default configuration implicated by the advisory), and a victim with an active Unica session must be induced to load attacker-controlled content - the UI:R metric confirms required user interaction such as clicking a crafted link or visiting a malicious page. The weak CSP is the enabling condition: it permits loading of malicious external resources and fails to block framing, which is what makes the XSS and clickjacking vectors viable. Limiting factors that reduce realistic risk: the attack is client-side only (no server-side code execution; C:L/I:L/A:N), it cannot proceed without victim interaction, and impact is confined to the victim's browser/session rather than the Unica server itself.

This is a genuinely moderate-to-low priority issue despite its MEDIUM 6.1 rating, and the signals are largely consistent. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable, low-complexity, unauthenticated flaw, but the UI:R requirement means a victim must perform an action (e.g., follow a crafted link or load a malicious page), and both confidentiality and integrity impacts are only Low with no availability impact - hallmarks of a client-side CSP/XSS/clickjacking weakness rather than server compromise. The scope change (S:C) reflects that impact crosses into the victim's browser context. EPSS is very low at 0.16% (5th percentile), there is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active or imminent widespread exploitation. No signals conflict here: the low EPSS, absence of KEV, and the client-side/user-interaction-dependent nature all align to indicate a real but non-urgent hardening issue. The CWE-358 (improperly implemented security check) and the description's framing as a 'misconfigured' CSP suggest this is a defense-in-depth weakening that makes other injection attacks easier rather than a directly weaponizable primitive on its own.

An attacker crafts a malicious link or page and lures an authenticated Unica user into visiting it; because the Content Security Policy is misconfigured, the browser loads attacker-controlled resources, enabling reflected/stored cross-site scripting or clickjacking against the user's session. No public exploit code is identified in the provided data, and success depends on the victim interacting with attacker-supplied content (UI:R).