EUVD-2026-46273
GHSA-6c63-v5g7-8937
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Version disclosure via HTTP headers is trivially performed with any HTTP client, warranting AC:L; no integrity or availability impact applies.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits.
AnalysisAI
Nginx server version disclosure in HCL IntelliOps Event Management (IEM) exposes the underlying web server version to unauthenticated remote attackers. This reconnaissance-class vulnerability allows adversaries to fingerprint the software stack, identify whether the nginx instance is outdated, and pivot to targeting known CVEs or publicly available exploits against that specific version. No public exploit code and no CISA KEV listing are associated with this CVE; the primary risk is as an enabler for follow-on attacks rather than direct exploitation.
Technical ContextAI
HCL IntelliOps Event Management is an IT operations and event correlation platform from HCL Software, identified by CPE cpe:2.3:a:hclsoftware:intelliops_event_management:*:*:*:*:*:*:*:*. The platform embeds an nginx web server component that, under certain conditions, reveals its version string - typically via the 'Server' HTTP response header or nginx-generated error pages. This falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the application inadvertently discloses implementation details that are not required for normal operation. The root cause is a missing or misconfigured 'server_tokens off' directive (or equivalent suppression) in the nginx configuration, which is a well-known hardening baseline for nginx deployments. By correlating the exposed version against public vulnerability databases, an attacker gains actionable intelligence about the attack surface without triggering any authentication checks.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132378 for the authoritative fix guidance. The standard remediation for nginx version disclosure is to add or enforce the directive 'server_tokens off;' in the nginx.conf http or server block, which suppresses the version string from both the Server response header and nginx-generated error pages; this carries no functional trade-off for normal application operation. Additionally, ensuring the embedded nginx instance is updated to a currently supported and patched release eliminates the underlying exposure that version disclosure enables. No exact patched IEM version number was provided in the available input data, so a specific upgrade target cannot be cited here - confirm the fix version from the vendor advisory. As a compensating control, network-layer restrictions (WAF or firewall rules) that limit access to the IEM web interface to trusted networks reduce the pool of attackers who can perform this fingerprinting.
More in Intelliops Event Management
View allClickjacking exposure in HCL IntelliOps Event Management (IEM) allows network-based attackers to embed the application i
Missing X-Content-Type-Options headers in Intelliops Event Management enable content-type sniffing attacks leading to sc
HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positione
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today