Hcl EUVD-2025-209072

This vulnerability presents a low-to-moderate real-world risk despite bearing an authentication-dependent nature. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) indicates that exploitation requires network access (AV:N), high attack complexity (AC:H), low privilege level authentication (PR:L), user interaction (UI:R), and affects only confidentiality (C:L) within a single security context (S:U). The CVSS base score of 2.6 reflects these constraints accurately. The SSVC decision framework classifies exploitation status as none (no evidence of active exploitation), the vulnerability as non-automatable (requires social engineering and user interaction), and technical impact as partial (limited to data disclosure). The combination of these signals-no known active exploitation, requirement for authenticated access with user interaction, and restricted impact scope-suggests this is a lower-priority vulnerability suitable for standard patching cycles rather than emergency remediation. However, in environments handling highly sensitive user data, the confidentiality exposure warrants timely mitigation.

An attacker crafts a malicious webpage and tricks an authenticated HCL Aftermarket DPC user (via phishing email or social engineering) into visiting it while the user remains logged into the application in another browser tab. The malicious webpage contains JavaScript that makes cross-origin requests to the Aftermarket DPC API; due to the CORS misconfiguration, the browser permits these requests and the API responds with sensitive user information (such as personal data or transaction details). The attacker's JavaScript then exfiltrates this data to an attacker-controlled server, compromising user privacy without the legitimate user's knowledge.