EUVD-2026-44921
GHSA-c44q-ff9x-p4wj
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Account takeover yields full C:H/I:H on victim account; A:N because availability is not impacted by response manipulation; all other metrics match exploitation prerequisites confirmed by description and CVSS vector.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.
AnalysisAI
Account takeover through HTTP response manipulation in HCL DFXAnalytics enables a network-positioned attacker to intercept and alter server responses before they reach the client, subverting authentication and authorization decisions enforced client-side. The product, identified via CPE cpe:2.3:a:hcl_software:dfxanalytics:*:*:*:*:*:*:*:*, appears to trust server-provided authentication outcomes without cryptographic integrity protection, allowing a low-privileged adversary-in-the-middle to gain unauthorized access to arbitrary user accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to occupy an adversary-in-the-middle (AiTM) network position on the path between the victim client and the HCL DFXAnalytics server - either via ARP spoofing, rogue routing, DNS manipulation, or a compromised network appliance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The composite risk picture is moderate-to-low for opportunistic attackers but meaningful for targeted attacks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privilege network access positions themselves between a legitimate user and the DFXAnalytics server - for example via ARP spoofing on a shared VLAN or by compromising a network device. When the victim authenticates, the attacker intercepts the server's HTTP response indicating authentication failure or a low-privilege role and replaces those fields with values indicating success or administrative access. … |
| Remediation | The primary remediation is to apply the patch or configuration fix detailed in HCL's advisory KB0131787 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787; an exact patched version number was not available in the provided intelligence and must be confirmed from that source. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Dfxanalytics
View allTLS protocol downgrade exposure in HCL DFXAnalytics allows network-positioned attackers to intercept and decrypt sensiti
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Stack-based buffer overflow in HCL DFXAnalytics allows remote unauthenticated attackers to crash or render the applicati
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Securi
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authent
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics fails to set the 'secure' attribute on session cookies generated during authentication, enabling a netw
Internal IP address exposure in HCL DFXAnalytics allows remote attackers who have obtained high-privilege authenticated
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today