EUVD-2025-209849
GHSA-28wj-h87j-w86h
Severity by source
AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal system architecture or configuration details, which may potentially assist in further analysis or targeted actions under certain conditions
AnalysisAI
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting authenticated users with local network access and specific user interaction. The exposure reveals internal system architecture and configuration information that could enable reconnaissance for targeted attacks, with limited confidentiality, integrity, and availability impact (CVSS 5.1, CWE-201). No public exploit code or confirmed active exploitation has been identified at time of analysis.
Technical ContextAI
This vulnerability is rooted in improper access control and information exposure (CWE-201), a classification for sensitive data disclosure that does not properly restrict access to system details. HCL AION, an enterprise integration and automation platform, exposes backend infrastructure specifics-potentially including system architecture, configuration parameters, internal hostnames, network topology, or service details-through an attack surface requiring adjacent network access (AV:A), high complexity (AC:H), low privilege level (PR:L), and user interaction (UI:R). The scope change (S:C) indicates the vulnerability impacts resources beyond the vulnerable component itself. The affected product spans all versions of HCL AION per the CPE cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:*, suggesting the issue is not version-specific but rather a design or default-configuration flaw.
RemediationAI
Consult HCL's official security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636 for vendor-released patches, specific patched versions, and release dates, as this information is not currently visible in public databases. Pending availability of a patched version, implement the following compensating controls with documented trade-offs: (1) Restrict network access to HCL AION administration and backend infrastructure interfaces to trusted administrative subnets only using network segmentation or firewalls-this eliminates adjacent-network attack vector (AV:A) but may complicate remote administration workflows; (2) Disable or restrict user interaction features that trigger information disclosure, if such features are documented in HCL AION's security hardening guide-side effect is reduced feature availability; (3) Revoke low-privilege accounts that do not require backend access and enforce least-privilege role assignments to reduce PR:L attack surface; (4) Enable logging and alerting on any access to backend infrastructure details and review logs for anomalous information queries. Monitor HCL's support portal for patch availability and apply as soon as released.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today