Aion
CVE-2025-52629
LOW
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | CVSS 3.7 (LOW). Attack vector: Network. Complexity: High. Privileges required: Low. User interaction: Required. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Aion. HCL AION is susceptible to Missing Content-Security-Policy.
An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.
Know when Aion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
HCL AION is susceptible to Missing Content-Security-Policy.
An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0.
Executive ViewAI
CVE-2025-52629 is a low-severity vulnerability in HCL AION (CVSS 3.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Affected Products (CPE)CVE.org
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-de
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclo
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user inte
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
GitHub PoC
Exploit-DB