EUVD-2025-210723
GHSA-7g45-8wrc-wrqg
Severity by source
AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Adjacent vector retained per vendor; AC lowered to L since scripted automation is inherently low-effort; UI:N because automated request flooding requires no victim interaction.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H
Lifecycle Timeline
1DescriptionCVE.org
HCL AION is affected by a vulnerability where certain endpoints lack sufficient anti-automation controls. Automated or scripted requests may be submitted without adequate rate limiting or challenge mechanisms, potentially resulting in unintended behavior or security impact under certain conditions.
AnalysisAI
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypass rate limiting and challenge mechanisms from an adjacent network position. The CVSS vector (AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates exploitation requires adjacent network access, elevated attack complexity, low-privileged credentials, and user interaction - substantially limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-307 root cause represents a well-understood attack class with available tooling in other contexts.
Technical ContextAI
HCL AION is an AI-driven business process automation platform. CWE-307 (Improper Restriction of Excessive Authentication Attempts) describes a failure to implement adequate controls - such as rate limiting, CAPTCHA challenges, account lockout policies, or token-based throttling - that would prevent automated or scripted clients from submitting high-volume requests to sensitive endpoints. The affected product is identified via CPE cpe:2.3:a:hcl_software:aion:*:*:*:*:*:*:*:*, with EUVD-2025-210723 specifically pinning the affected release to AION v2.1.0. The absence of anti-automation defenses on specific API or authentication-adjacent endpoints allows bots and scripts to enumerate values, attempt credential stuffing, or flood those endpoints without triggering countermeasures. The 'Information Disclosure' tag in the intelligence data suggests at least some affected endpoints may expose sensitive data through automated enumeration, supplementing the availability impact reflected in the A:H CVSS metric.
RemediationAI
Consult the HCL vendor advisory KB0133084 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133084 for patching guidance; a specific fixed version number is not independently confirmed in the available intelligence data and should be obtained directly from HCL. As compensating controls, administrators should implement network-layer rate limiting on the affected AION endpoints via a reverse proxy or web application firewall, throttling request volume per source IP and authenticated session. Enabling detailed logging and alerting on anomalous request frequency to identified endpoints provides detection capability in the interim. Restricting access to AION endpoints at the network perimeter to trusted adjacent-network segments aligns with the AV:A attack vector and reduces exposure. These controls may interfere with legitimate automated integrations built on top of AION, so thorough testing against production workflows prior to enforcement is advisable.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today