Monthly
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.