EUVD-2025-210751
GHSA-7jvc-7ww6-f6w9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Authenticated low-privilege network access required (PR:L, AV:N); audit omission constitutes low integrity impact; S:C reflects downstream SIEM/audit platform data-completeness loss.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.
AnalysisAI
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Technical ContextAI
HCL IntelliOps Event Management is an enterprise IT workflow and event orchestration platform (cpe:2.3:a:hcl_software:iem:*:*:*:*:*:*:*:*). The root cause is CWE-221 (Information Omission), where the application omits security-relevant events from its audit trail - a class of defect distinct from data disclosure but consequential for detection and response. In event management platforms, comprehensive logging is architecturally critical: these systems are often positioned as aggregators for downstream SIEMs, so omitted records create blind spots not only within IEM but in any dependent security tooling. The CVSS vector's Scope:Changed (S:C) metric is consistent with this cascading audit-gap impact, where the affected component's logging failure degrades the integrity of a separate audit or monitoring system.
RemediationAI
Consult the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456 for patch availability; no specific fixed version is confirmed in the available intelligence and the phrase 'Patch available per vendor advisory' applies at best. If patching must be deferred, compensating controls include enabling OS-level audit daemons (e.g., auditd on Linux hosts running IEM) or network-layer logging (WAF access logs, NetFlow) to capture workflow activity that IEM fails to record - note this creates log fragmentation requiring additional SIEM correlation rules and analyst effort. Restrict IEM access to the minimum necessary accounts to reduce the population of users whose actions go unlogged, and increase alerting sensitivity on the surrounding infrastructure. Organizations with compliance obligations should formally document this control gap in their risk register and apply a compensating control record until a vendor patch is validated and deployed.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to acces
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privileg
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the app
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today