EUVD-2026-44916
GHSA-c2j4-gprf-37xq
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
MITM positioning plus a victim HTTP request are required (AC:H, UI:R); only the cookie leaks (C:L), with no direct integrity/availability impact and no scope change.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
AnalysisAI
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Technical ContextAI
The affected component is HCL DFXAnalytics (CPE cpe:2.3:a:hcl_software:dfxanalytics), an HCL analytics application. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), manifesting specifically as the omission of the HTTP 'Secure' cookie attribute. When a cookie lacks the Secure flag, the user agent is permitted to include that cookie on plain HTTP requests as well as HTTPS, so any protocol downgrade, mixed-content resource, or forced HTTP navigation to the application's domain leaks the session identifier. This is a session-management hardening defect rather than a memory-safety or injection flaw; the underlying HTTPS/TLS channel itself is not broken, but the application does not instruct the browser to confine cookies to it.
RemediationAI
Consult HCL advisory KB0131787 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787) and upgrade to the fixed release above version 3.0; the input does not state an exact fix version, so treat this as 'Patch available per vendor advisory' and confirm the target build directly with HCL. As compensating controls while patching, enforce HTTPS-only access by enabling HSTS (Strict-Transport-Security with a long max-age and includeSubDomains) so browsers refuse plaintext requests that would leak the cookie, and terminate or redirect all HTTP (port 80) traffic to HTTPS at the load balancer or reverse proxy - note that aggressive HSTS can break any legitimately HTTP-only subdomain and should be scoped carefully. Where the platform allows, inject the Secure (and HttpOnly) attribute on the session cookie at the reverse proxy or web server layer as an interim mitigation. Restricting the application to trusted networks or VPN shrinks the population of potential interceptors but does not remove the underlying defect.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today