EUVD-2026-44920
GHSA-4m7f-pc5f-972q
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
MitM downgrade requires network positioning (AC:H) and victim browsing action (UI:R), but no attacker privileges; confidentiality rated L because cleartext interception exposes session data.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.
AnalysisAI
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Technical ContextAI
HTTP Strict Transport Security (HSTS) is a web security policy mechanism defined in RFC 6797 that instructs browsers to reject any HTTP connection to a host and automatically upgrade requests to HTTPS for a defined period. Without it, an adversary able to intercept network traffic can strip TLS on the initial connection before the browser has an opportunity to self-enforce HTTPS, enabling a classic SSL-stripping MitM attack. The assigned CWE-200 (Information Exposure) reflects the potential disclosure of session data or application traffic over a downgraded cleartext channel, though CWE-319 (Cleartext Transmission of Sensitive Information) is arguably more precise for this root cause class. The CPE string cpe:2.3:a:hcl_software:dfxanalytics:*:*:*:*:*:*:*:* indicates all released versions of HCL DFXAnalytics are affected, with no version floor or ceiling published.
RemediationAI
The primary remediation is to configure all HCL DFXAnalytics web application response handlers to emit the Strict-Transport-Security header, for example: Strict-Transport-Security: max-age=31536000; includeSubDomains. Consult the vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787 for vendor-specific patching or configuration guidance; a precise patched version is not confirmed from available data. As a compensating control pending application-level remediation, administrators can enforce HSTS at a reverse proxy or load balancer (nginx, HAProxy, F5) in front of DFXAnalytics, which injects the header without requiring application changes - note this only protects traffic passing through the proxy and does not address any direct application-to-client paths. Additionally, restricting DFXAnalytics to HTTPS-only at the network perimeter (disabling port 80 or redirecting all HTTP to HTTPS at the ingress layer) reduces the window for SSL-stripping attacks, though it does not substitute for the HSTS header itself.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today