What is the CVSS score of CVE-2025-62343?

CVE-2025-62343 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL IEM CVE-2025-62343

EUVD-2025-210806 LOW

Concurrency Issues (CWE-557)

2026-08-27 HCL

GHSA-vf69-7295-r5qp

Information Disclosure Hcl Iem Hcl Software

3.1

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

AC:H reflects mandatory prior token theft; UI:R because victim admin session must exist; C:L for limited session data exposure only.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 18:27 vuln.today

DescriptionCVE.org

HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion.

AnalysisAI

Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.

Technical ContextAI

HCL IntelliOps Event Management (IEM) is an IT operations event management platform by HCL Software, identified by CPE cpe:2.3:a:hcl_software:hcl_iem:*:*:*:*:*:*:*:*. The root cause is classified under CWE-557 (Concurrency Issues with Locks), framed by the vendor as an 'Admin Session Concurrency Vulnerability,' suggesting the session lifecycle management does not atomically invalidate all server-side session references upon logout - likely a race condition or incomplete session teardown path when concurrent admin sessions exist. In practice, the behavioral outcome resembles CWE-613 (Insufficient Session Expiration): the session token issued at login is not authoritatively revoked server-side, so replaying it after logout continues to yield authenticated access. Affected versions are v1.3 and v1.4 per EUVD-2025-210806.

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131777 (KB0131777) for official patch or upgrade guidance; a specific fixed version is not independently confirmed from the available data beyond what the vendor discloses there. As a compensating control, administrators should enforce short absolute session timeouts at the application or reverse-proxy layer to limit the window during which a stale token remains usable - note this may affect legitimate long-running administrative workflows. Additionally, restricting access to the HCL IEM admin interface to trusted network segments or VPN reduces exposure to token interception. Audit session token revocation logic in any custom integrations with the IEM API, as those may also be affected by the incomplete logout path.