EUVD-2025-209848
GHSA-c489-5hxx-grxc
Severity by source
AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensitive information. Such behaviour may allow exposure of data to external systems under specific conditions.
AnalysisAI
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affecting confidentiality and integrity under specific conditions. The vulnerability requires adjacent network access, low privilege authentication, and user interaction to exploit, making it suitable for targeted attacks within trusted environments rather than widespread remote exploitation.
Technical ContextAI
HCL AION is an integration and automation platform. The vulnerability involves unintended out-of-band interactions-unexpected network requests or data flows initiated by the application to external systems without explicit user authorization. CWE-201 (Information Exposure Through Sent Data) indicates the root cause is improper handling of sensitive data that gets transmitted outside intended boundaries. The adjacent network access vector (AV:A) suggests the attacker must be on the same local network segment or directly connected network, not Internet-accessible. The high attack complexity (AC:H) and required user interaction (UI:R) indicate exploitation is not trivial and depends on specific operational conditions or user actions within the application.
RemediationAI
Consult HCL's official advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636 for vendor-released patches or fixes; specific patch versions are not confirmed in available data. As interim compensating controls, restrict network access to AION instances using firewalls and network segmentation to limit adjacent network connectivity, implement egress filtering to prevent unauthorized out-of-band communications to external systems, disable or restrict AION features that trigger external interactions if not operationally necessary, enforce strong access controls and authentication on AION administrative and operational accounts to reduce compromised account risk, and monitor network traffic from AION systems for unexpected external connections. Note that these controls mitigate attack surface but do not resolve the underlying vulnerability; vendor patch deployment is required for complete remediation.
Inline script execution allowed in CSP vulnerability has been identified in HCL AION v2.0
A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially le
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today