EUVD-2025-210804
GHSA-pvr3-52wm-4cjw
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Network vector confirmed by SSRF class; AC:H reflects mandatory pre-compromised internal host prerequisite; PR:L and UI:R align with authenticated, user-triggered exploitation path.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.
AnalysisAI
Server-side request forgery in HCL Connections allows a low-privileged, authenticated attacker - operating from or through a compromised internal server - to issue unauthorized outbound requests to internal resources, resulting in limited information disclosure or potential security control bypass. The vulnerability carries a low CVSS base score of 3.7 due to high attack complexity, required user interaction, and unchanged scope, and no public exploit or CISA KEV listing exists at time of analysis. Risk is constrained by the prerequisite of a pre-compromised internal host, making this a meaningful lateral-movement enabler rather than a direct initial-access vector.
Technical ContextAI
HCL Connections is an enterprise social collaboration platform (formerly IBM Connections). CWE-918 (Server-Side Request Forgery) describes a class of vulnerability where a server-side component can be induced to issue HTTP or protocol requests to arbitrary destinations chosen by the attacker, potentially reaching internal services that would otherwise be network-isolated. In this case the CVSS vector AV:N/AC:H/PR:L/UI:R indicates the attack is network-delivered, requires low-level authenticated access, demands user interaction (suggesting a crafted link or content submission path), and involves high complexity - consistent with exploitation through a trusted but compromised internal server rather than a direct external request. No CPE string was provided, so exact affected versions must be derived from the vendor's KB0128493 advisory.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128493 (KB0128493) for the specific patched version and upgrade instructions; an exact fix version was not present in the available intelligence data, so 'Patch available per vendor advisory' is the applicable patch status. As a compensating control pending patching, restrict outbound HTTP/HTTPS requests from the HCL Connections application server using egress firewall rules or a forward proxy allowlist, limiting reachable destinations to only required external endpoints - this directly mitigates SSRF impact by preventing unauthorized internal traversal. Additionally, harden internal network segmentation so that the Connections server cannot reach sensitive internal services (metadata APIs, internal admin endpoints) that should be unreachable from application-layer hosts. Note that egress filtering may require testing to avoid breaking legitimate Connections federation or notification features.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today