HCL AION CVE-2025-52625
LOWSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability
Cacheable SSL Page Found vulnerability has been identified
in HCL AION.
Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser
This issue affects AION: 2.0.
AnalysisAI
HCL AION 2.0 improperly caches sensitive SSL/HTTPS page content, allowing attackers or local users with device or browser access to retrieve cached credentials, system identifiers, and internal file paths. The vulnerability has a CVSS score of 3.7 (low severity) due to high attack complexity and local/physical access requirements, with no public exploit or active exploitation confirmed.
Technical ContextAI
This vulnerability stems from improper cache control headers on SSL/HTTPS pages (CWE-525: Information Exposure Through Query Strings in URL). When web applications fail to set appropriate Cache-Control, Pragma, or Expires headers with no-cache/no-store directives, browsers and intermediate caches (proxies, CDNs) may store sensitive response bodies. In AION 2.0, authentication credentials and system metadata intended for single-session use are retained in accessible cache storage, exploitable by anyone with local file system or browser history access. The root cause is likely missing or improperly configured HTTP cache-prevention headers on authentication or administrative endpoints.
RemediationAI
Contact HCL support via the security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444 for patched version availability and specific update instructions. If patched versions are available, upgrade AION to the minimum recommended version. Interim compensating controls include: (1) Configure web server (nginx, Apache, etc.) to enforce strict Cache-Control headers (no-cache, no-store, must-revalidate) on all AION authentication and administrative endpoints-this prevents browser and proxy caching of sensitive responses with minimal performance impact; (2) Educate users to disable browser cache for sensitive domains or use private/incognito browsing modes when accessing AION from shared or untrusted devices; (3) Implement HTTPS-only (HSTS headers) to prevent downgrade attacks that could expose cached plaintext responses; (4) Review AION configuration documentation for any session-specific cache directives that may be disabled by default and should be re-enabled. Without vendor guidance, these controls reduce but do not eliminate risk.
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today