HCL Unica
CVE-2025-31998
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach COM web interface over network
-
DeliverySubmit malformed/unexpected request
-
ExploitTrigger unhandled exception
-
ExecutionReceive verbose error/stack trace
-
PersistHarvest internal system details
-
ImpactChain leaked info into targeted follow-on attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the HCL Unica Centralized Offer Management web application; per CVSS PR:N/UI:N no authentication or user interaction is needed, and it applies to default deployments where unhandled exceptions return verbose error/stack-trace output to the client. The practical limiting factor is that the direct payoff is only information disclosure - actual RCE or DoS depends on the disclosed details revealing a separately exploitable known vulnerability in the target's specific version/stack, so impact is contingent rather than guaranteed. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8 Critical) overstates the direct impact of this flaw. The underlying weakness is CWE-209 (information exposure through unhandled exceptions/error messages); the description itself frames remote code execution and denial of service only as downstream attacks an adversary might launch AFTER using the leaked information - not as direct consequences of this bug. That makes the I:H/A:H components speculative: the confirmed, first-order impact is confidentiality loss (verbose error/stack-trace data), so a more defensible score is ~7.5 (C:H only). Supporting exploitation signals are modest and do not indicate urgency: EPSS is 0.39% (31st percentile), there is no CISA KEV listing, and no public exploit code was identified. Net assessment: a genuine information-disclosure weakness with a low real-world exploitation probability, whose 9.8 rating is inflated by mapping hypothetical follow-on RCE/DoS into the base metrics - treat as a moderate-priority hardening issue rather than a critical emergency, and verify the true I/A impact with HCL. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends malformed or unexpected input to HCL Unica Centralized Offer Management, triggering an unhandled exception that returns a verbose error or stack trace disclosing internal details (software versions, paths, configuration, or component names). The attacker uses this leaked fingerprint to identify and target known vulnerabilities in the stack for follow-on RCE or DoS. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensitive details through unhandled exception messages, because the application returns verbose error or stack-trace output to clients. The published CVSS is 9.8 Critical, but independent assessment scopes the direct impact to confidentiality only (C:H/I:N/A:N); any follow-on remote code execution or denial of service is contingent on the leaked information revealing a separately exploitable flaw in the target's specific version and stack. No public exploit identified at time of analysis; CISA KEV status is not indicated, and EPSS is low at 0.39% (31st percentile).
RemediationAI
Apply the fix documented in HCL advisory KB0124422 for the affected HCL Unica Centralized Offer Management version; the input data does not include an exact patched version number, so consult that advisory for the supported fixed release. As a compensating control, configure the web/application server to use generic error pages and suppress verbose stack traces, debug output, and detailed exception messages; the trade-off is that this can complicate troubleshooting and hide application faults. Restrict network access to the Unica Centralized Offer Management interface behind VPN, allowlists, or reverse-proxy ACLs where business requirements permit; the trade-off is reduced accessibility for legitimate remote users. Monitor application and web server logs for repeated exception-triggering requests, and ensure dependent components are patched because leaked version or configuration data may support follow-on exploitation of separately known vulnerabilities.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-209, generation of error messages containing sensitive information, in HCL Unica Centralized Offer Management (CPE cpe:2.3:a:hcltech:unica_centralized_offer_management:*:*:*:*:*:*:*:*). The affected web application does not properly handle exceptions and exposes stack traces, file paths, configuration details, database errors, or component versions to remote clients. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates it 9.8 Critical, but the authoritative independent assessment recalibrates it to AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N because the vulnerability itself only leaks information; it does not provide direct code execution, data modification, or denial of service. The practical risk is that disclosed technical details could help an attacker identify and exploit a separate known vulnerability in the environment.
Know when Hcl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated error-message leakage (AV:N/AC:L/PR:N/UI:N) yields only confidentiality loss; I/A set to N since RCE/DoS are hypothetical downstream attacks, not this flaw's direct impact.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.
Executive ViewAI
HCL Unica Centralized Offer Management is affected by a remote information disclosure flaw that can expose sensitive system details through verbose error messages. While the advisory carries a critical CVSS rating, direct business impact is currently limited to confidentiality, and there is no public exploit identified at time of analysis. Leadership should care because affected systems may leak information useful for follow-on attacks, requiring exposure reduction and patch tracking even without an immediate operational outage.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to trusted sources/VPN, deploy WAF/IPS rules to block verbose error and stack-trace patterns, configure HCL Unica Centralized Offer Management to suppress detailed error messages, monitor logs for exception-based reconnaissance, and track HCL advisory for a vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)NVD
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Authorization bypass in HCL Unica Centralized Offer Management allows a remote, authenticated user to read database reco
GitHub PoC
Exploit-DB