EUVD-2025-210750
GHSA-j6g8-4gxh-5h5w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible flaw requiring low-privilege credentials (PR:L, AV:N); C:L and I:L reflect untracked information disclosure and log integrity degradation; no availability impact applies.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
AnalysisAI
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Technical ContextAI
HCL IntelliOps Event Management (IEM) is an enterprise IT operations management and event correlation platform. The vulnerability is classified under CWE-778 (Insufficient Logging), meaning the application fails to generate or retain adequate audit log entries for security-relevant actions such as authentication attempts, privilege access requests, or administrative operations. This is a detective control failure rather than a direct exploitation primitive - it degrades the accountability layer, impairs incident response, and enables attackers to iterate on privilege probing without producing forensic artifacts. The CPE string cpe:2.3:a:hcl_software:iem:*:*:*:*:*:*:*:* uses a wildcard version field, indicating HCL has not bounded the affected version range in their CPE data, and all known versions should be treated as potentially affected until the vendor advisory clarifies a fixed release.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456 for patch details and the exact fixed version, which was not independently confirmed from the available data - apply any vendor-released update promptly. As compensating controls while the patch is evaluated, deploy centralized SIEM or external audit logging at the network or host layer to capture authentication events, privilege access requests, and administrative API calls that IEM itself may not log; note this captures traffic metadata but not necessarily application-layer context. Restrict authenticated access to IEM to the minimum required personnel and enforce least-privilege role assignments to reduce the attack surface for undetected privilege probing. Network-level access controls (firewall rules limiting IEM reachability to authorized hosts only) further reduce the pool of potential authenticated users who could exploit the logging gap.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to acces
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user t
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the app
Same weakness CWE-778 – Insufficient Logging
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today