EUVD-2025-209659
GHSA-wwg7-35h6-45wq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS)
AnalysisAI
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.
Technical ContextAI
HCL DFXAnalytics uses HTTP security headers to control resource loading and script execution in browsers. The Content-Security-Policy (CSP) header is a critical defense mechanism that restricts which origins can load resources and where code can execute. The vulnerability stems from insufficient CSP directives: the object-src directive controls whether plugins (Flash, Java) can be embedded, and base-uri restricts where the HTML <base> tag can point. Without strict settings (such as object-src 'none' and base-uri 'self'), attackers can inject malicious content or manipulate the DOM base URL to redirect resource requests to attacker-controlled servers. This is classified under CWE-358 (Improperly Restricted Operations on Dynamically-Loaded Code) and relates to improper trust assumptions in client-side security controls. The issue allows XSS payloads to bypass the intended CSP restrictions.
RemediationAI
HCL has published guidance via KB article KB0130569 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130569. The primary remediation is to upgrade to a patched version of HCL DFXAnalytics once released by HCL. In the interim, implement the following compensating controls: configure the web server hosting DFXAnalytics to enforce strict Content-Security-Policy headers, specifically adding directives 'object-src "none"' to block plugin execution and 'base-uri "self"' to restrict base URL manipulation. Apply these headers at the server level (via Apache mod_headers, nginx add_header, or IIS configuration) to ensure they apply to all responses from DFXAnalytics. Additionally, restrict network access to DFXAnalytics to trusted IP ranges or require VPN/authentication proxies upstream. Deploy a Web Application Firewall (WAF) with XSS detection rules to block injected scripts. These compensating controls do not eliminate the vulnerability but reduce the attack surface while awaiting patches.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Share
External POC / Exploit Code
Leaving vuln.today