EUVD-2026-64837
GHSA-782w-m9ch-xmp8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-accessible endpoint requires no authentication (PR:N); UI:R reflects active browsing to Swagger; C:L captures API structure exposure with no credential or PII leak confirmed.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.
AnalysisAI
HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTTP methods, request/response schemas, and operational surface without access controls. While no credentials or PII are directly disclosed per the vendor's assessment, the exposed documentation materially reduces the reconnaissance effort required for follow-on attacks against the API. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The Swagger documentation endpoint must be publicly accessible over the network without authentication, which appears to be the default or common production deployment state for affected HCL Hive versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects the moderate, reconnaissance-only nature of this exposure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated external attacker navigates directly to the HCL Hive Swagger UI endpoint (e.g., /swagger-ui.html) on an internet-facing deployment, browses the full OpenAPI specification to enumerate all API routes, accepted parameters, authentication schemes, and data models. Armed with this reconnaissance map, the attacker crafts targeted API requests to probe for authorization flaws, injection points, or business logic vulnerabilities in specific endpoints-dramatically reducing the time required for follow-on attack development. … |
| Remediation | Consult the HCL knowledge base article KB0131731 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131731 for the vendor-recommended fix; an exact patched version number is not specified in currently available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, contain
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly do
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and in
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to con
Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticat
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today