EUVD-2026-44919
GHSA-m9fr-x8w8-9mm4
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CSRF attacker needs no system privileges (PR:N); victim authentication and interaction are captured by UI:R; AC:H reflects combined dependency on absent Anti-CSRF tokens and active victim session.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
AnalysisAI
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Technical ContextAI
The SameSite cookie attribute - introduced to address CSRF - instructs browsers whether to include a cookie in cross-site requests: Strict blocks all cross-origin inclusion, Lax blocks most (excluding top-level GET navigations), and an absent attribute historically defaulted to None (always sent). HCL DFXAnalytics (CPE: cpe:2.3:a:hcl_software:dfxanalytics:*:*:*:*:*:*:*:*) omits this attribute on authentication session cookies, leaving the door open for CSRF in browsers that do not enforce a Lax default, or in request types exempt from Lax (e.g., POST). The assigned CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is a notable mismatch - the precise classification for this flaw is CWE-1275 (Sensitive Cookie with Improper SameSite Attribute) or CWE-352 (Cross-Site Request Forgery); the misclassification may affect downstream tooling that relies on CWE filtering. The root cause is an omitted security flag at cookie-generation time, compounded by the absence of a secondary defense layer such as synchronizer Anti-CSRF tokens.
RemediationAI
Apply the vendor-supplied fix documented in HCL Knowledge Base article KB0131787 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787; an exact patched version number is not independently confirmable from the available data, so refer to the advisory for the precise upgrade target. Where immediate patching is not feasible, the most effective compensating control is to configure the application to explicitly set SameSite=Strict or SameSite=Lax on all session cookies - Strict provides the strongest CSRF protection but will break legitimate cross-origin navigation flows (e.g., links from external portals landing in authenticated sessions), while Lax is a safer operational compromise. Independently, implementing synchronizer Anti-CSRF tokens on all state-changing requests (POST, PUT, DELETE) eliminates the CSRF risk regardless of cookie attribute state; the CVE description explicitly identifies the absence of this control as the factor that allows exploitation. Additionally, pairing the SameSite fix with the Secure and HttpOnly cookie flags reduces unrelated session-hijacking exposure with no meaningful operational trade-off.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today