HCL Unica CVE-2025-31993

The attacker must be able to send a crafted request to a network-reachable instance of HCL Unica Centralized Offer Management and reach the specific input field that accepts a URL/host value which the server then fetches; per CVSS PR:N/UI:N no authentication or user interaction is required. The precise vulnerable parameter or feature is not named in the available data. Realistic exploitation is limited by whether the application is exposed to the attacker's network segment (internal vs. internet-facing deployment) and by what internal services or metadata endpoints are reachable from the server - SSRF value depends heavily on the surrounding network and egress controls.

Signals here are strongly divergent and warrant a tempered priority rather than treating the 9.8 at face value. The supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a remote, unauthenticated, low-complexity flaw with full triple impact - but a CWE-918 Server-Side Request Forgery very rarely yields native High integrity AND High availability impact on the vulnerable host itself; the C:H/I:H/A:H combination looks inflated for an SSRF and the unchanged-scope (S:U) is also questionable, since SSRF value usually comes from pivoting to OTHER internal systems (scope change). This suggests the vendor-assigned score is conservative/worst-case rather than tightly reasoned. Countervailing exploitation signals are weak: EPSS is only 0.24% (14th percentile), this CVE is NOT in CISA KEV, and no public exploit or POC is referenced - so there is no public exploit identified at time of analysis. Net: a genuinely exploitable unauthenticated SSRF in an internet-reachable marketing application is worth patching promptly because SSRF commonly enables internal reconnaissance, cloud-metadata credential theft, and lateral movement - but the near-floor EPSS and absence of KEV/POC indicate this is not under active mass exploitation and should be prioritized below products with confirmed in-the-wild activity. The impact subscores should be independently verified with HCL before accepting 9.8 as the operative risk.

An unauthenticated attacker who can reach the Unica Centralized Offer Management web interface submits a crafted input (e.g., a URL/host parameter) that the server fetches without validation, coercing the server into making attacker-controlled outbound requests. This is used to reach internal-only services or a cloud metadata endpoint to harvest credentials and map the internal network. No public exploit code is identified at time of analysis, so exploitation would require an attacker to develop their own request.