Hcl EUVD-2025-209055

The CVSS 3.1 score of 5.9 reflects a moderate vulnerability with mixed risk signals. The vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:L) indicates network accessibility and no privilege requirement, but high attack complexity and user interaction reduce practical exploitability. Notably, the impact profile shows high confidentiality impact (session takeover enabling unauthorized transaction viewing) but no integrity impact and low availability impact, which is inconsistent with the threat description mentioning unauthorized transactions-suggesting the integrity concern may be understated or non-captured in the CVSS assessment. CISA's SSVC decision framework rates exploitation as "none" with "no" automatable status, indicating this is not currently a priority for coordinated vulnerability remediation and requires manual, user-specific targeting. The high attack complexity likely stems from the user interaction requirement (victim must visit attacker-controlled content or follow a crafted link). Overall, this is a real but not immediately critical threat-it requires victim social engineering and careful session manipulation, limiting its impact compared to vulnerabilities with low AC and no UI requirements.

An attacker crafts a malicious URL containing a session identifier they have created on the Aftermarket DPC application and sends it to a legitimate user via phishing email or social engineering. When the user clicks the link and authenticates to the application, the attacker can then reuse the same session identifier (which remains valid post-authentication due to the session fixation flaw) to access the user's account and perform unauthorized transactions such as viewing sensitive transactional data or initiating fraudulent activity on the user's behalf. The high attack complexity likely reflects the attacker's need to carefully time the exploitation window and ensure the victim uses the injected session, rather than any technical barriers to triggering the flaw itself.