EUVD-2026-46341
GHSA-hcwc-9g7x-xf5j
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Server version disclosure via HTTP headers is typically unauthenticated and low-complexity; vendor's PR:H/AC:H appears conservative and should be verified, so AV:N/AC:L/PR:N is assessed independently.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.
AnalysisAI
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or application-layer output - enabling attackers to fingerprint the exact deployment version and correlate it against public vulnerability databases. The vendor-provided CVSS vector (AV:N/AC:H/PR:H/UI:N) constrains realistic risk significantly: exploitation requires both high privilege and high attack complexity, meaning this is not an opportunistic or mass-exploitable weakness. The vulnerability functions primarily as a reconnaissance enabler for chaining into separate, more severe attacks; no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
HCL MyCloud (CPE: cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*) is classified under CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Server version disclosure is a well-understood information leakage class in which web application frameworks, HTTP response headers (e.g., Server:, X-Powered-By:, or custom headers), or application error pages inadvertently include software version identifiers. This metadata is not sensitive in isolation, but allows an attacker to precisely target known CVEs applicable to the disclosed version, converting a low-severity information leak into a reconnaissance multiplier. The wildcard CPE version range indicates all currently known versions of HCL MyCloud carry this behavior.
RemediationAI
Consult HCL Software's advisory KB0132381 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 for the primary fix; no exact patched version number is independently confirmed from the available data. As compensating controls where immediate patching is not feasible, administrators should configure the application server or any fronting reverse proxy (e.g., nginx, Apache httpd) to suppress or replace the Server:, X-Powered-By:, and any HCL-specific version disclosure headers in outbound HTTP responses - note that header suppression does not eliminate version strings embedded in application error pages, API responses, or login pages, which must be addressed separately. Web application firewall (WAF) rules can be deployed to strip version patterns from outbound traffic as an additional defense layer. These compensating controls address symptom exposure only and are not root-cause fixes; they should be paired with the vendor-released patch once a specific version is confirmed.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercep
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessio
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication token
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-110
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today