EUVD-2025-210722
GHSA-cg9m-h438-9c8x
Severity by source
AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L
Local-only access, high privilege and complexity requirements, and mandatory user interaction all confirmed by description; scope change reflects cross-component storage boundary crossing.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
1DescriptionCVE.org
HCL AION is affected by a vulnerability where the shared storage used by product components is architected without sufficient access separation. Processes sharing the storage may be able to access or modify files beyond their intended scope, potentially resulting in unintended behavior or security impact under certain conditions.
AnalysisAI
Insufficient access separation in HCL AION's shared storage architecture allows processes within the platform to access or modify files outside their intended scope. The CVSS vector (AV:L/AC:H/PR:H/UI:R/S:C) confirms exploitation requires local access with high privileges, high complexity conditions, and user interaction - all of which must align simultaneously. No public exploit code exists, and CISA has not added this to the Known Exploited Vulnerabilities catalog, placing this firmly in the medium-severity tier despite the scope change flag.
Technical ContextAI
HCL AION is an enterprise AI-driven business process automation platform whose components communicate and share data via a common storage layer. The vulnerability arises from a design-level weakness: the shared storage is not partitioned with sufficient mandatory access controls between co-resident processes, meaning a process that legitimately accesses the storage could traverse beyond its assigned namespace to read or write files belonging to peer components. No CWE identifier was assigned, but the flaw most closely resembles improper access control or insecure shared resource design patterns. The CVSS scope metric S:C reflects that exploitation crosses the security boundary between distinct software components sharing the same physical or logical storage, even though the overall impact ratings (C:L/I:L/A:L) remain low. No CPE strings were provided in the intelligence data to further narrow affected platform versions.
RemediationAI
Consult the HCL Software knowledge base article KB0133084 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084 for vendor-released guidance and any available patch or configuration fix. An exact patched version was not specified in the provided intelligence data, so patch availability should be verified directly against the advisory. As a compensating control pending a patch, administrators should audit and enforce OS-level file system permissions on AION shared storage directories so that each component process runs under a dedicated service account with least-privilege access scoped to its own namespace. Restricting shared storage directories via discretionary access controls (chmod/ACLs on Linux, NTFS permissions on Windows) limits cross-component file traversal. Be aware that overly restrictive permissions may disrupt inter-component communication and should be tested in a staging environment before production deployment. If high-sensitivity data (credentials, workflow configs) resides in the shared storage path, consider relocating it to separately permissioned locations as an additional control.
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today