Hcl CVE-2025-55270

The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) indicates network-accessible attack surface with low complexity, but requires authenticated access (PR:L) and user interaction (UI:R), limiting real-world exploitability. The SSVC decision framework signals exploitation status as none, non-automatable exploitation, and partial technical impact-consistent with a vulnerability requiring user participation and offering confined confidentiality exposure without integrity or availability compromise. The CVSS score of 3.5 reflects this constraint; the threat remains real for authenticated insiders but is not a critical remote code execution scenario. Absence of known public exploit code and lack of active exploitation data further reduce urgency, though the multiple injection vectors suggest the vulnerability warrants timely patching to eliminate post-authentication attack surface.

An authenticated user with legitimate access to HCL Aftermarket DPC crafts a malicious input string (e.g., in a product search field or form parameter) containing SQL injection or JavaScript payload. Due to improper input validation, the payload is reflected back in the application response or executed in a backend query. If the user shares a specially crafted URL with another authenticated user and tricks them into clicking it (satisfying the UI:R requirement), the victim's browser executes the injected script or the database processes the SQL injection, potentially exfiltrating sensitive product or customer data. The attack requires authentication and user interaction but can be conducted remotely over the network.