EUVD-2025-210805
GHSA-xmgh-r945-wq5r
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H
Attacker requires no credentials - only a captured token - so PR:N; availability impact unsupported by session expiration mechanics, so A:N.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.
AnalysisAI
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
Technical ContextAI
HCL IntelliOps Event Management (IEM) is an enterprise IT operations event management platform. The affected CPE is cpe:2.3:a:hcl_software:iem:*:*:*:*:*:*:*:*, covering versions 1.3 and 1.4 per EUVD-2025-210805. The root cause is CWE-613 (Insufficient Session Expiration): a conformant implementation must invalidate the server-side session record at logout or account deletion - clearing the client-side cookie alone is insufficient. When the server retains the session as valid, any party holding the token (obtained via prior interception, log exposure, or a secondary attack vector) can replay it post-logout to authenticate as the original user. The CVSS vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:H) indicates network exploitability but with significant prerequisites: high complexity, some level of authenticated access, and user interaction, which together reflect the requirement to first capture the session token through a separate mechanism before the termination event occurs.
RemediationAI
Administrators should consult the HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131777 to obtain the patched release; the specific fixed version number is not independently confirmable from available intelligence and must be verified directly with HCL support. As a compensating control pending patch deployment, enforce short absolute session timeout values at the application tier or upstream reverse proxy - if IEM supports configurable session expiration, set it to the minimum operationally acceptable window to reduce the exploitation interval for any captured tokens. Restrict network access to the IEM web interface to trusted internal segments or VPN-only paths, which reduces the attack surface for session token interception. Monitoring for reuse of the same session token from multiple source IPs or after expected logout events can provide detection coverage while the patch is staged.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to acces
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privileg
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user t
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the app
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today