EUVD-2026-46344
GHSA-592r-85ww-g563
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Network vector with high complexity and user interaction required; authenticated session prerequisite (PR:L); only partial confidentiality loss from cookie scope leakage.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected with Cookie Attribute Path Not Set. It may increase the risk of unauthorized access to session data or authentication tokens.
AnalysisAI
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication tokens to be transmitted to all paths within the application domain rather than restricted to intended endpoints. The CVSS 2.6 score reflects a genuinely limited-impact finding requiring both high attack complexity and authenticated user interaction to exploit, with only low confidentiality impact and no integrity or availability consequences. No public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
HCL MyCloud (CPE: cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*) is an HCL Software enterprise product. The vulnerability is formally tagged CWE-614 (Sensitive Cookie in HTTPS Session Without 'Secure' Attribute), though the description specifically identifies the Path attribute as the missing control - a subtle but distinct issue. The Path attribute constrains which URL paths trigger the browser to include the cookie in requests. When omitted, browsers default to sending the cookie to every path under the origin, increasing the exposure surface: unintended endpoints, background requests, or scripts at other paths may receive the session cookie. This enlarges the window for session token interception or cross-path leakage compared to properly scoped cookies. Note: the mismatch between CWE-614 (Secure attribute) and the described finding (Path attribute) should be verified against the vendor advisory at KB0132381.
RemediationAI
The primary remediation is to apply the vendor-supplied fix detailed in HCL Software advisory KB0132381 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381). An exact patched version number is not independently confirmed from the available input data - consult the advisory directly for the target upgrade version. As a compensating control pending patching, administrators can configure the application server or reverse proxy to inject a restrictive Path attribute (e.g., Path=/) on session cookies at the perimeter layer, limiting cookie scope. Additionally, ensuring the Secure and HttpOnly attributes are also set on session cookies will reduce the broader cookie security risk surface. These controls carry minimal operational trade-offs and are standard hardening practices regardless of this specific CVE.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercep
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessio
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-110
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or applicat
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today