EUVD-2025-209854
GHSA-rm7f-v2gq-q2mw
Severity by source
AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to potential interception or unauthorized access during transmission under certain conditions
AnalysisAI
HCL AION transmits backend service details over unencrypted HTTP channels under certain conditions, allowing authenticated local or adjacent-network attackers with limited privileges to intercept and read sensitive configuration data through man-in-the-middle attacks. The vulnerability requires user interaction and non-default network positioning, resulting in a CVSS score of 4.3 (low severity) with confirmed vendor awareness and advisory availability.
Technical ContextAI
This vulnerability stems from CWE-319 (Cleartext Transmission of Sensitive Information), a class of weaknesses where sensitive data traverses the network without cryptographic protection. HCL AION, a data integration and orchestration platform, handles backend service configuration and connection details that must remain confidential. The vulnerability manifests when the application's backend service communication layer fails to enforce HTTPS/TLS encryption in specific operational contexts, leaving HTTP as an available-and potentially default or fallback-protocol option. The affected scope is limited by the CVSS vector requirement for adjacent network positioning (AV:A), indicating the threat model involves local network compromise or insider positioning rather than internet-facing exposure.
RemediationAI
Contact HCL support and apply the patch specified in KB0130636 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636) for your installed AION version, as specific patch versions are not confirmed in publicly available data. As interim compensating controls, enforce HTTPS/TLS for all AION backend service communication through network policies and firewall rules limiting HTTP traffic on AION service ports, implement mutual TLS (mTLS) authentication between frontend and backend components to add encryption even if HTTP is used (though not a substitute for HTTPS), restrict AION deployment to isolated network segments with access control lists limiting adjacency to trusted administrative staff, and disable any legacy HTTP-only service discovery or configuration endpoints if available in the administration interface. Network-level enforcement such as requiring VPN access for AION service management reduces the attack surface by preventing direct adjacent-network positioning.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today