EUVD-2026-34787
GHSA-xg6r-cjq3-qmj5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (HCL) · only source for this CVE.
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.
AnalysisAI
Host header injection in HCL Digital Experience and HCL Digital Experience Compose enables unauthenticated remote attackers to manipulate HTTP Host headers, causing the application to generate attacker-controlled redirect URLs targeting victims - a classic open redirect primitive (CWE-601) confirmed by the Open Redirect tag. The CVSS 6.1 score reflects Changed scope (S:C), meaning impact crosses beyond the vulnerable component, with low confidentiality and integrity impact consistent with phishing and session-hijacking abuse. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
HCL Digital Experience is an enterprise web experience and portal platform; the Compose variant extends it with additional content management capabilities (CPE: cpe:2.3:a:hclsoftware:digital_experience_&_dx_compose:*:*:*:*:*:*:*:*). Host header injection exploits the pattern where server-side code constructs absolute URLs, password-reset links, or redirects by reading the HTTP Host header directly from the incoming request rather than from a server-side configured canonical hostname. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) classifies the root cause: attacker-supplied Host values propagate into redirect targets or generated links without validation, allowing the site to redirect authenticated or unauthenticated users to arbitrary external domains. The Changed scope in the CVSS vector confirms the impact escapes the application's own trust boundary into the user's browser context.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130849 for patched release versions and upgrade instructions - no specific fixed version number is confirmed from the data available for this analysis. As a compensating control pending patch deployment, configure a reverse proxy or WAF rule to validate the HTTP Host header against an explicit allowlist of legitimate hostnames, rejecting or rewriting requests that present unexpected values; note this control may require adjustment in multi-tenant or load-balanced environments where multiple legitimate hostnames are used. Additionally, configure the application to derive canonical base URLs from server-side settings (e.g., explicit base URL configuration) rather than the incoming Host header, which eliminates the injection point architecturally. Restrict external access to the application to trusted networks where feasible to reduce the phishing-delivery attack surface.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today