EUVD-2025-209857
GHSA-63f7-76jf-xf93
Severity by source
AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs, or intermediary systems, potentially leading to unintended information disclosure under certain conditions.
AnalysisAI
HCL AION exposes sensitive information through URL parameters, allowing disclosure via browser history, server logs, and intermediary systems. The vulnerability requires adjacent network access, high interaction complexity, and authenticated user involvement, resulting in limited confidentiality impact with a CVSS score of 2.6. No active exploitation has been confirmed.
Technical ContextAI
HCL AION improperly passes sensitive data as URL query parameters rather than using secure HTTP methods (POST with body, encrypted headers) or secure storage mechanisms. This violates secure coding practices defined in CWE-598 (GET with Sensitive Information), where sensitive authentication tokens, session identifiers, or user credentials transmitted in URLs become accessible through multiple vectors: browser history caches, HTTP access logs on intermediate proxies and web servers, referrer headers sent to third-party sites, and system-level URL monitoring. The vulnerability affects all versions of HCL AION according to the CPE pattern, indicating a systemic design issue rather than a narrow code defect.
RemediationAI
Apply HCL's security guidance from KB0130636 immediately, which provides vendor-recommended mitigations specific to AION's architecture. Primary fix involves refactoring all sensitive data transmission from URL parameters to HTTP POST request bodies or secure header mechanisms. For immediate risk reduction without code changes: configure web servers and proxies to sanitize logs of sensitive URL parameters using regex filters on query strings; enforce HTTPS with HSTS headers to prevent cleartext interception; restrict browser history retention policies on user devices; disable referrer headers for sensitive endpoints using Referrer-Policy: no-referrer. Trade-offs include potential performance overhead from increased payload size (POST vs. GET) and operational complexity in log filtering. If AION requires URL-based session tokens for backward compatibility, migrate to secure cookie-based session management with HttpOnly and Secure flags set.
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today