EUVD-2025-209850
GHSA-g36x-vg49-93vr
Severity by source
AV:A/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be stored in the browser, potentially leading to unintended exposure under specific conditions.
AnalysisAI
HCL AION stores sensitive information in browser auto-complete caches for certain input fields, potentially exposing credentials or other sensitive data to local attackers or through browser history under specific conditions. The vulnerability requires adjacent network access, high interaction complexity, and local user privilege, limiting real-world exploitation scope but posing risk in shared or compromised workstations.
Technical ContextAI
The vulnerability stems from CWE-201 (Insertion of Sensitive Information into Sent Data), which occurs when web applications enable HTML5 autocomplete attributes on password, username, or other sensitive input fields. Browser auto-complete functionality is designed to cache form data for user convenience but can inadvertently persist credentials in plaintext browser storage (autocomplete cache or local storage) accessible to other local users, scripts, or through browser forensics. The affected product is HCL AION (all versions per CPE), a software platform by HCL Software. The flaw is a design/configuration issue rather than a memory safety or logic error - the application fails to explicitly disable autocomplete on sensitive fields via autocomplete='off' or equivalent mechanisms.
RemediationAI
Apply the security patch or upgrade provided by HCL Software via their support portal at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636 - consult the advisory for the specific fixed version. Pending patch deployment, disable auto-complete on sensitive input fields by adding autocomplete='off' or autocomplete='new-password' to HTML form elements handling credentials, secrets, or personally identifiable information. For browser-based deployments, configure the application server to enforce HTTP headers such as Cache-Control: no-store and Pragma: no-cache to reduce browser caching of sensitive pages. Educate end-users to avoid saving credentials in browser password managers for shared or untrusted workstations, and configure browsers to clear auto-complete cache on logout. Note that disabling autocomplete may degrade user experience for legitimate users but is essential in multi-user environments.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today