Aion
CVE-2025-55249
LOW
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
AnalysisAI
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. [CVSS 3.5 LOW]
Technical ContextAI
Classified as CWE-693 (Protection Mechanism Failure). Affects Aion. HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today