HCL Unica CVE-2025-31997

Exploitation requires network access to the Unica Centralized Offer Management application's HTTP interface and the ability to supply a direct object reference (such as a record, offer, or file identifier) in a request; the flaw is that the server fails to enforce per-object authorization. No user interaction is needed. The vendor vector asserts no authentication (PR:N), but because this is an IDOR/authorization-bypass class issue, realistic exploitation typically assumes the attacker can already reach an application endpoint and, in most IDOR cases, holds a valid low-privileged session - a limiting factor defenders should confirm against their deployment. Impact is confined to unauthorized reads (confidentiality); there is no stated data modification or service disruption.

This is a serious confidentiality flaw but its real-world priority sits below its 7.5 CVSS score. The vendor-supplied CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes remote, low-complexity, unauthenticated exploitation with high confidentiality impact and no integrity or availability effect - consistent with an IDOR (CWE-639) that lets an attacker enumerate and read database records or files belonging to other principals. Counterbalancing signals point to lower urgency: EPSS is only 0.22% (12th percentile), the CVE is NOT on CISA KEV, and no public exploit code has been identified, so there is no public exploit identified at time of analysis. One internal tension to verify: the vulnerability class is an IDOR / authorization bypass, which in practice almost always presupposes an established application session, yet the vendor rated PR:N (unauthenticated). This should be confirmed with HCL - if a low-privileged authenticated session is in fact required, true exposure is narrower than the PR:N vector implies. No SSVC decision data was provided. Net: a genuine data-exposure bug worth patching on a normal enterprise cadence, not an emergency, absent any evidence of exploitation.

A remote attacker reaching the Unica Centralized Offer Management web interface manipulates a direct object identifier (e.g., an offer, record, or file ID in a request parameter) to reference resources they are not authorized to view, and the application returns another tenant's or user's data without an authorization check. No public proof-of-concept is known, and the low attack complexity means scripted enumeration of sequential IDs could harvest sensitive marketing/offer data at scale once access to the endpoint is obtained.