EUVD-2025-210725
GHSA-crvg-56hm-8qcq
Severity by source
AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Adjacent-only access, low-privilege authentication, and mandatory user interaction match description; scope change and confidentiality-only impact reflect CWE-116 output-encoding flaw reaching a secondary context.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL AION is affected by a vulnerability where certain input fields do not enforce sufficient server-side input validation. Unexpected or crafted input may be accepted by the application, potentially resulting in unintended behavior or security impact under certain conditions.
AnalysisAI
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output), indicating that the application accepts and processes input without adequate server-side sanitization or encoding before rendering or passing it downstream. This class of flaw can manifest as cross-site scripting (XSS) or injection into adjacent components, consistent with the CVSS scope change (S:C) that suggests the confidentiality impact escapes the vulnerable component into a secondary context such as a browser session or connected service. The CPE string (cpe:2.3:a:hcl_software:aion:*:*:*:*:*:*:*:*) covers HCL AION broadly, with EUVD data pinning the confirmed affected version to v2.1.0. HCL AION is an enterprise AI and workflow automation platform.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084 for patch or upgrade guidance; an exact fixed version number is not independently confirmed from available data, so the advisory should be treated as the authoritative source. As a compensating control pending patching, restrict network access to HCL AION instances to trusted VLANs or VPN segments to mitigate the AV:A constraint - this eliminates access by untrusted adjacent-network users. Additionally, enforce strict role-based access controls to limit the population of low-privileged accounts that can interact with the affected input fields. Disabling or rate-limiting the affected input functionality, if identifiable from the advisory, would further reduce exposure with minimal operational impact.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Same weakness CWE-116 – Improper Encoding or Escaping of Output
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today