EUVD-2025-210753
GHSA-8m7h-pjww-w469
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Aligns with provided vector: network-reachable, high-privilege required, high-complexity exploitation, changed scope with high confidentiality and low integrity impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
AnalysisAI
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Technical ContextAI
HCL IntelliOps Event Management (IEM), identified by CPE cpe:2.3:a:hcl_software:iem:*:*:*:*:*:*:*:*, is an enterprise IT operations management platform. CWE-272 (Least Privilege Violation) describes a class of flaw where a software component operates with more privileges than are necessary, or where privilege boundaries are not correctly enforced between roles. In this case, an already-privileged user can leverage improperly enforced access controls within IEM to reach resources or data normally gated behind a higher privilege tier. The Changed scope (S:C) in the CVSS vector confirms the attacker moves beyond the authorization boundary of their original component, consistent with horizontal or vertical privilege escalation within the application layer. The network attack vector indicates this does not require local system access.
RemediationAI
Review the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456 for the specific patched version of IEM; the exact fix version is not independently confirmed from the available input data - patch version should be verified directly from the vendor advisory. As a compensating control prior to patching, enforce strict role separation within IEM so that high-privileged accounts are limited to the fewest personnel necessary, reducing the pool of accounts that could be used to trigger the flaw. Additionally, review IEM audit logs for anomalous access patterns where lower-tier resources are being accessed by accounts with elevated roles. Restricting network access to the IEM management interface to trusted administrative subnets reduces exposure to network-based exploitation, though note this does not eliminate the vulnerability for internal users.
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privileg
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user t
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the app
Same weakness CWE-272 – Least Privilege Violation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today