EUVD-2026-44924
GHSA-493w-xg7v-8gmv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible dashboard requires no authentication (PR:N, AV:N); disclosure yields only file path enumeration with no integrity or availability impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation.
AnalysisAI
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.
Technical ContextAI
CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause: the DFXAnalytics dashboard fails to sanitize or suppress verbose error output before returning it to the client, allowing internal absolute file paths and directory structure to leak. The CPE cpe:2.3:a:hcl_software:dfxanalytics:*:*:*:*:*:*:*:* uses a full wildcard version field, indicating no version of HCL DFXAnalytics is immune based on current NVD data. HCL DFXAnalytics is an enterprise analytics platform; the dashboard is the specific attack surface, making this a classic improper error handling issue where production systems inadvertently expose debug-level information.
RemediationAI
Consult HCL Software knowledge base article KB0131787 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787 for the vendor-recommended patch or configuration fix; an exact patched version number is not confirmed in the available data. As compensating controls pending patching: configure the application to use production-mode error handling that suppresses verbose stack traces and debug output before they reach the HTTP response (note this may reduce diagnostic visibility for operators); deploy a web application firewall rule to detect and strip or block responses containing file system path patterns (e.g., Unix-style absolute paths or Windows drive letters in HTTP bodies); and where feasible, restrict access to the DFXAnalytics dashboard to known internal IP ranges to reduce the unauthenticated remote attack surface. Each of these controls carries operational trade-offs - WAF path-stripping may break legitimate error UX, and IP restriction may impact remote users.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today