HCL AION CVE-2025-52634
LOWSeverity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible with high attack complexity; low confidentiality impact, no integrity or availability loss.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.
AnalysisAI
Information disclosure in HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information via a high-complexity attack. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.03%). The vulnerability affects only version 2.0.
Technical ContextAI
The root cause class is CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. CPE data confirms the affected product is HCL AION 2.0.0. The exact mechanism (e.g., misconfigured endpoint, insecure file exposure) is not detailed, but the high attack complexity suggests the information disclosure requires precise conditions, such as a race condition or multi-step bypass of access controls.
RemediationAI
Apply the vendor-supplied patch detailed in HCL support article KB0124444. The exact patched version is not provided in the NVD data; consult the advisory for the correct upgrade path. If immediate patching is not possible, restrict network access to the AION service via firewall rules, but this may interfere with legitimate users.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today