EUVD-2026-63323
GHSA-hg5c-cxw6-wgq4
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
PR:H and UI:R reflect mandatory high-privilege victim session and active social engineering; S:C captures cross-origin browser boundary crossing; no availability impact applies.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
AnalysisAI
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user holding high-privileged credentials in IEM (PR:H per CVSS vector) to actively visit an attacker-controlled web page in the same browser where an IEM session is active (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.8 Medium score reflects a meaningful but constrained attack surface: the two most significant limiters are PR:H (the victim must hold high-privileged IEM credentials) and UI:R (the victim must actively visit an attacker-controlled page while authenticated). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a publicly reachable web page and embeds JavaScript that issues fetch requests with credentials to a target organization's IEM instance. A high-privileged IEM user is lured to this page - via a phishing email or malicious link - while their IEM browser session is active; because IEM returns overly permissive or absent CORS headers, the browser forwards the session cookie and allows the attacker's script to read the IEM API response, potentially harvesting event data, configuration details, or user information. … |
| Remediation | The primary remediation is to apply the vendor-supplied fix documented in the HCL Software advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to acces
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privileg
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user t
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today