HCL DFXAnalytics EUVD-2025-209665

Exploitation requires the following specific conditions: the attacker must possess valid authentication credentials with at least low privilege level to access the HCL DFXAnalytics application; the attacker must trigger an application error condition within DFXAnalytics that causes the application to generate a detailed stack trace in an HTTP response; and the error handling implementation must fail to sanitize or suppress the stack trace information before returning the response to the authenticated user. The vulnerability is limited by the requirement for low-privilege authentication (not unauthenticated remote access), the need to trigger a specific error condition (not a default state), and the high attack complexity indicated by the CVSS AC:H component, which suggests error conditions are not trivially or reliably reproducible. These factors prevent exploitation against default configurations and limit the practical attack surface to scenarios where an attacker has legitimate authenticated access and knowledge of how to induce application failures.

This vulnerability presents low real-world risk despite its network-accessible nature, supported by converging signals from multiple frameworks. The CVSS 3.1 score reflects the limited impact: the attack vector is network-based (AV:N), but attack complexity is high (AC:H), requiring privileged authentication (PR:L), and affecting only confidentiality (C:L) with no integrity or availability impact (I:N/A:N). The CVSS score classification (3.1 = Low severity) aligns with the information-disclosure-only nature of the vulnerability. Exploitation requires an authenticated attacker with low privileges who encounters a specific error condition complex enough to trigger a full stack trace response, limiting automatable attack surface. The vulnerability does not enable privilege escalation, code execution, or system compromise; its value to an attacker lies primarily in reconnaissance for subsequent attacks. While stack trace information can support threat actors in vulnerability research or targeted exploitation planning, this is a secondary concern compared to direct system compromise. The absence of any public exploit code, active exploitation reports, or CISA KEV listing further indicates this is not a priority threat. Organizations should remediate through patching, but this should not compete with critical or high-severity vulnerabilities for immediate patching resources.

An authenticated user with low privileges logging into HCL DFXAnalytics intentionally or inadvertently triggers an application error-such as by submitting malformed input to an API endpoint or querying an unavailable resource. The application responds with an unfiltered HTTP error message containing a detailed Java or application-framework stack trace, revealing internal package names, method calls, third-party library versions, and potentially configuration details. The attacker captures and analyzes this stack trace to map the application's architecture, identify potentially vulnerable code paths or outdated dependencies, and inform a secondary targeted attack. The high attack complexity requirement suggests the error condition is not trivially triggerable and may require specific knowledge of application behavior or deliberate manipulation to force a traceback-generating failure.