HCL DFXAnalytics CVE-2026-35143

The CVSS vector (UI:R) confirms a victim who is actively authenticated to HCL DFXAnalytics must visit or load an attacker-controlled page - passive presence on the network is insufficient. The CVE description explicitly states that exploitation is conditional on the application not implementing supplemental mitigations such as Anti-CSRF tokens; a deployment that enforces synchronizer token validation is not exploitable via this path regardless of the missing SameSite attribute. High attack complexity (AC:H) reflects the combined preconditions: active victim session, absence of Anti-CSRF tokens, and a request type not protected by modern browser SameSite=Lax defaults (i.e., cross-site POST rather than a top-level navigation). Modern browsers (Chrome 80+, Firefox 79+, Edge 86+) enforce SameSite=Lax by default when the attribute is absent, which blocks most CSRF vectors in those environments; older browsers or non-browser HTTP clients do not apply this default. The attacker must also know or guess a valid, exploitable DFXAnalytics endpoint to target.

The vendor-assigned CVSS 3.0 Low score is well-supported by the vector breakdown: AC:H reflects the multi-condition dependency (victim must hold an active session AND the application must lack Anti-CSRF tokens), UI:R captures the mandatory victim interaction, and I:L reflects limited-scope integrity impact with no confidentiality or availability consequence. PR:L in the vendor vector implies the attacker holds some low-privilege access - possibly reflecting the need to understand target endpoints to craft a convincing forged request, though for classic CSRF the attacker typically needs no system privileges (PR:N is arguably more accurate; see assessed vector). The S:C (scope changed) metric is consistent with CSRF's cross-origin nature, where a resource outside the attacker's direct control (the victim session) is affected. No EPSS score is available in the provided data; given the low CVSS, absent KEV listing, absent POC, and widespread modern-browser Lax defaults, exploitation probability is assessed as very low in most contemporary deployments. The CWE-200 misclassification is flagged explicitly - defenders should not rely on CWE-352 or CWE-1275 filters to surface this issue in automated tooling.

An attacker with knowledge of a state-changing DFXAnalytics endpoint (such as a user-settings update or data export trigger) hosts a webpage containing a forged cross-origin POST request targeting that endpoint. The attacker delivers a link to the page to a victim who is currently authenticated to DFXAnalytics; when the victim's browser loads the page, it automatically includes the session cookie in the forged request - since SameSite is unset - causing the server to execute the action under the victim's credentials. No public proof-of-concept code has been identified; the attack additionally requires that the target deployment lacks Anti-CSRF token validation.