HCL Unica Platform CVE-2025-52614

Exploitation requires the HCL Unica Platform to issue a session/authentication cookie without the HttpOnly attribute (the vulnerable default behavior per the advisory), and requires the victim to be an active/authenticated Unica user who follows an attacker-supplied link (UI:R). The missing HttpOnly flag alone does not disclose the cookie; a companion mechanism that runs script in the victim's browser context (e.g., an XSS flaw or malicious page interacting with the application) is needed to actually read the cookie. Limiting factors: mandatory user interaction, dependence on a secondary script-execution vector, confidentiality-only impact (I:N/A:N), and the relatively small deployment footprint of Unica.

This is a genuinely low-priority issue despite the 'Medium' CVSS label. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a confidentiality-only weakness that requires victim interaction, and the signals align consistently toward low real-world risk: EPSS is 0.14% (3rd percentile), indicating negligible predicted exploitation; there is no CISA KEV listing and no public exploit identified. The vulnerability (CWE-614, session cookie missing the HttpOnly flag) is not directly exploitable on its own - it is an enabling weakness that lowers the bar for cookie theft if a separate client-side scripting (XSS) flaw is also present, so its impact is contingent and secondary. No SSVC decision data was provided in the input. The PR:N in the vector denotes an unauthenticated vector, but note that practical exploitation still requires tricking a user into following a crafted link and typically a companion script-injection vector, so the effective barrier is higher than the raw score suggests. No conflicting signals between sources were observed; all available indicators (low EPSS, no KEV, no POC, low single-impact CVSS) point the same direction.

An attacker lures an authenticated HCL Unica user into following a crafted link, either directly or via a malicious/compromised site. Because the session cookie lacks the HttpOnly attribute, any client-side script that executes in the victim's browser context can read the cookie value, enabling session token theft and potential account impersonation. No public exploit code is identified at time of analysis, and realistic exploitation generally depends on chaining with a separate script-injection flaw.