Aion
Monthly
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypass rate limiting and challenge mechanisms from an adjacent network position. The CVSS vector (AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates exploitation requires adjacent network access, elevated attack complexity, low-privileged credentials, and user interaction - substantially limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-307 root cause represents a well-understood attack class with available tooling in other contexts.
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affecting confidentiality and integrity under specific conditions. The vulnerability requires adjacent network access, low privilege authentication, and user interaction to exploit, making it suitable for targeted attacks within trusted environments rather than widespread remote exploitation.
HCL AION exposes sensitive information through URL parameters, allowing disclosure via browser history, server logs, and intermediary systems. The vulnerability requires adjacent network access, high interaction complexity, and authenticated user involvement, resulting in limited confidentiality impact with a CVSS score of 2.6. No active exploitation has been confirmed.
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting authenticated users with local network access and specific user interaction. The exposure reveals internal system architecture and configuration information that could enable reconnaissance for targeted attacks, with limited confidentiality, integrity, and availability impact (CVSS 5.1, CWE-201). No public exploit code or confirmed active exploitation has been identified at time of analysis.
HCL AION stores sensitive information in browser auto-complete caches for certain input fields, potentially exposing credentials or other sensitive data to local attackers or through browser history under specific conditions. The vulnerability requires adjacent network access, high interaction complexity, and local user privilege, limiting real-world exploitation scope but posing risk in shared or compromised workstations.
HCL AION uses basic authorization tokens for authentication, exposing credentials to interception or misuse if not transmitted over encrypted channels. The vulnerability affects authenticated local or adjacent network attackers with low privileges and user interaction, resulting in limited confidentiality impact. CVSS 3.0 reflects low severity, though the underlying authentication weakness may enable credential theft in environments with unencrypted internal traffic.
HCL AION fails to configure security-related HTTP response headers, potentially reducing browser-based protections against cross-site scripting and other client-side attacks. The vulnerability requires adjacent network access, high interaction complexity, low privilege authentication, and user interaction to achieve limited confidentiality impact. CVSS score of 2.3 reflects minimal real-world risk under current attack conditions.
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that could lead to account compromise or unauthorized access. The vulnerability requires adjacent network access and affects all versions of the product. No public exploit code has been identified, but the weak authentication controls represent a significant credential-stuffing and password-guessing risk in multi-tenant or shared-network environments.
HCL AION transmits backend service details over unencrypted HTTP channels under certain conditions, allowing authenticated local or adjacent-network attackers with limited privileges to intercept and read sensitive configuration data through man-in-the-middle attacks. The vulnerability requires user interaction and non-default network positioning, resulting in a CVSS score of 4.3 (low severity) with confirmed vendor awareness and advisory availability.
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive information to interception or unauthorized access. The vulnerability requires adjacent network access, high attack complexity, and user interaction, limiting real-world exploitation scope. No active exploitation has been confirmed at time of analysis.
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.
A security vulnerability in HCL AION (CVSS 1.9). Remediation should follow standard vulnerability management procedures.
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour.
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing the traceability of user activities and potentially compromising monitoring, accountability, and incident investigation capabilities. The vulnerability affects AION 2.0 and is classified as an Information Disclosure issue with a CVSS score of 5.8. An attacker with local access and low privileges could exploit this to perform actions without adequate logging, hindering forensic analysis and compliance audit trails.
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in HCL AION (CVSS 1.8). Remediation should follow standard vulnerability management procedures.
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.
HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. [CVSS 3.1 LOW]
HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. [CVSS 3.7 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, potentially increasing exposure to cr (CVSS 4.6).
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. [CVSS 3.7 LOW]
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0 [CVSS 4.5 MEDIUM]
Aion versions up to 2.0 contains a vulnerability that allows attackers to the use of easily guessable passwords, potentially resulting in unauthorized acc (CVSS 3.1).
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. [CVSS 1.8 LOW]
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. [CVSS 3.1 LOW]
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. [CVSS 3.5 LOW]
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised. [CVSS 2.4 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to malicious file uploads, potentially resulting in unauthorized code execution or (CVSS 2.7).
Aion versions up to 2.0 contains a vulnerability that allows attackers to unintended storage of sensitive or dynamic content, potentially resulting in una (CVSS 2.8).
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because the application fails to set cache-prevention headers (CWE-525). An attacker with local access to a browser cache, shared endpoint, or disk image could recover this data without authenticating to AION, but the independent assessment rates this as low confidentiality impact (CVSS AV:L) rather than the vendor’s 7.5 (AV:N), since prior cache access is required. No public exploit code or active exploitation has been identified, and EPSS is 0.03%.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclosure vulnerability (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). This flaw requires only network reachability to the AION instance and has high confidentiality impact with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.03% (9th percentile).
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker who can observe traffic between a victim's browser and the server can capture the session token in cleartext and hijack the authenticated session. The issue affects AION 2.0.0 (CPE cpe:2.3:a:hcltech:aion:2.0.0) and is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by the vendor, though our independent assessment adjusts the attack complexity to High because exploitation additionally requires cleartext HTTP reachability or downgradability plus a man-in-the-middle/passive sniffing position; if AION is served strictly over HTTPS with HSTS and no HTTP listener, the cookie never leaves the browser in plaintext and the flaw is effectively unexploitable. No public exploit code has been identified and there is no evidence of active exploitation, and the EPSS score is negligible at 0.02% (5th percentile), consistent with a low-likelihood, moderate-severity configuration/hygiene flaw rather than a remote pre-auth compromise vector.
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user interaction (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is very low at 0.03% (9th percentile), indicating limited real-world targeting despite the high base score. The vendor advisory does not detail the affected feature or protocol, and the product's niche deployment footprint further reduces exposure.
Missing Content-Security-Policy response headers in the HCL AION web interface remove the browser-enforced allowlist that restricts where scripts, styles, and other resources may be loaded from, degrading a key defense-in-depth control against cross-site scripting (CWE-1032, security misconfiguration). The gap has no standalone exploit path: an attacker would first need a separate, independently exploitable content-injection or XSS flaw in AION, and the assessed vector (CVSS 3.1, 3.7 base, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) caps the resulting impact at limited confidentiality exposure with no integrity or availability effect. No public exploit code exists and no active exploitation has been confirmed at time of analysis, so this should be treated as a low-severity hardening finding rather than a directly exploitable vulnerability.
Indirect prompt injection in HCL AION v2.5.0 enables authenticated network attackers to embed HTML markup into AI-generated rendered output, which may then be displayed to other platform users and trigger unintended browser behavior. Classified under CWE-1427 - a category specific to AI/LLM output sanitization failures - the vulnerability carries a vendor-assigned CVSS 4.3 Medium rating reflecting limited confidentiality impact and an authentication prerequisite. No public exploit code or active exploitation has been identified at time of analysis.
Insufficient server-side input validation in HCL AION v2.1.0 allows a low-privileged, adjacent-network attacker to submit crafted input that bypasses validation controls, resulting in limited confidentiality disclosure via a scope change to a dependent component. Exploitation requires user interaction, constraining opportunistic use. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
JavaScript hijacking in HCL AION v2.1.0 exposes sensitive data from dynamic JavaScript responses to attacker-controlled pages under specific network and user interaction conditions. The vulnerability arises because JSON or JavaScript-formatted responses from AION can be referenced cross-origin by a malicious page, enabling data capture via classic JS hijacking techniques. No public exploit has been identified at time of analysis, and the low CVSS score of 3.7 reflects high attack complexity and constrained impact scope.
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypass rate limiting and challenge mechanisms from an adjacent network position. The CVSS vector (AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H) indicates exploitation requires adjacent network access, elevated attack complexity, low-privileged credentials, and user interaction - substantially limiting opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CWE-307 root cause represents a well-understood attack class with available tooling in other contexts.
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affecting confidentiality and integrity under specific conditions. The vulnerability requires adjacent network access, low privilege authentication, and user interaction to exploit, making it suitable for targeted attacks within trusted environments rather than widespread remote exploitation.
HCL AION exposes sensitive information through URL parameters, allowing disclosure via browser history, server logs, and intermediary systems. The vulnerability requires adjacent network access, high interaction complexity, and authenticated user involvement, resulting in limited confidentiality impact with a CVSS score of 2.6. No active exploitation has been confirmed.
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting authenticated users with local network access and specific user interaction. The exposure reveals internal system architecture and configuration information that could enable reconnaissance for targeted attacks, with limited confidentiality, integrity, and availability impact (CVSS 5.1, CWE-201). No public exploit code or confirmed active exploitation has been identified at time of analysis.
HCL AION stores sensitive information in browser auto-complete caches for certain input fields, potentially exposing credentials or other sensitive data to local attackers or through browser history under specific conditions. The vulnerability requires adjacent network access, high interaction complexity, and local user privilege, limiting real-world exploitation scope but posing risk in shared or compromised workstations.
HCL AION uses basic authorization tokens for authentication, exposing credentials to interception or misuse if not transmitted over encrypted channels. The vulnerability affects authenticated local or adjacent network attackers with low privileges and user interaction, resulting in limited confidentiality impact. CVSS 3.0 reflects low severity, though the underlying authentication weakness may enable credential theft in environments with unencrypted internal traffic.
HCL AION fails to configure security-related HTTP response headers, potentially reducing browser-based protections against cross-site scripting and other client-side attacks. The vulnerability requires adjacent network access, high interaction complexity, low privilege authentication, and user interaction to achieve limited confidentiality impact. CVSS score of 2.3 reflects minimal real-world risk under current attack conditions.
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that could lead to account compromise or unauthorized access. The vulnerability requires adjacent network access and affects all versions of the product. No public exploit code has been identified, but the weak authentication controls represent a significant credential-stuffing and password-guessing risk in multi-tenant or shared-network environments.
HCL AION transmits backend service details over unencrypted HTTP channels under certain conditions, allowing authenticated local or adjacent-network attackers with limited privileges to intercept and read sensitive configuration data through man-in-the-middle attacks. The vulnerability requires user interaction and non-default network positioning, resulting in a CVSS score of 4.3 (low severity) with confirmed vendor awareness and advisory availability.
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive information to interception or unauthorized access. The vulnerability requires adjacent network access, high attack complexity, and user interaction, limiting real-world exploitation scope. No active exploitation has been confirmed at time of analysis.
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries.
A security vulnerability in HCL AION (CVSS 1.9). Remediation should follow standard vulnerability management procedures.
HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour.
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing the traceability of user activities and potentially compromising monitoring, accountability, and incident investigation capabilities. The vulnerability affects AION 2.0 and is classified as an Information Disclosure issue with a CVSS score of 5.8. An attacker with local access and low privileges could exploit this to perform actions without adequate logging, hindering forensic analysis and compliance audit trails.
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
A remote code execution vulnerability in HCL AION (CVSS 1.8). Remediation should follow standard vulnerability management procedures.
A security vulnerability in HCL AION (CVSS 4.8). Remediation should follow standard vulnerability management procedures.
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.
HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. [CVSS 3.1 LOW]
HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.. [CVSS 3.7 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, potentially increasing exposure to cr (CVSS 4.6).
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. [CVSS 3.7 LOW]
HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting and other content injection attacks by allowing unsafe scripts or resources to execute..This issue affects AION: 2.0. [CVSS 3.7 LOW]
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0 [CVSS 4.5 MEDIUM]
Aion versions up to 2.0 contains a vulnerability that allows attackers to the use of easily guessable passwords, potentially resulting in unauthorized acc (CVSS 3.1).
HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information disclosure or aiding further attacks. [CVSS 1.8 LOW]
HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise. [CVSS 3.1 LOW]
HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall security posture and increase its susceptibility to common web-based attacks. [CVSS 3.5 LOW]
HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized access if the token is compromised. [CVSS 2.4 LOW]
Aion versions up to 2.0 contains a vulnerability that allows attackers to malicious file uploads, potentially resulting in unauthorized code execution or (CVSS 2.7).
Aion versions up to 2.0 contains a vulnerability that allows attackers to unintended storage of sensitive or dynamic content, potentially resulting in una (CVSS 2.8).
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-depth control disabled rather than directly enabling remote code execution. The vendor scores this 9.8, but our assessment identifies a sharp conflict with that label: exploitation is client-side, requires high complexity and user interaction, and is limited to low confidentiality and integrity impact within the victim's browser context. No public exploit was identified at time of analysis, and EPSS is 0.03% (percentile 9%), so active exploitation is not indicated.
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because the application fails to set cache-prevention headers (CWE-525). An attacker with local access to a browser cache, shared endpoint, or disk image could recover this data without authenticating to AION, but the independent assessment rates this as low confidentiality impact (CVSS AV:L) rather than the vendor’s 7.5 (AV:N), since prior cache access is required. No public exploit code or active exploitation has been identified, and EPSS is 0.03%.
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Policy header, potentially enabling cross-site scripting (XSS) and injection attacks. No active exploitation or public exploit code is known; EPSS score is 0.02%, indicating a very low probability of real-world exploitation.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclosure vulnerability (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). This flaw requires only network reachability to the AION instance and has high confidentiality impact with no integrity or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.03% (9th percentile).
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker who can observe traffic between a victim's browser and the server can capture the session token in cleartext and hijack the authenticated session. The issue affects AION 2.0.0 (CPE cpe:2.3:a:hcltech:aion:2.0.0) and is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) by the vendor, though our independent assessment adjusts the attack complexity to High because exploitation additionally requires cleartext HTTP reachability or downgradability plus a man-in-the-middle/passive sniffing position; if AION is served strictly over HTTPS with HSTS and no HTTP listener, the cookie never leaves the browser in plaintext and the flaw is effectively unexploitable. No public exploit code has been identified and there is no evidence of active exploitation, and the EPSS score is negligible at 0.02% (5th percentile), consistent with a low-likelihood, moderate-severity configuration/hygiene flaw rather than a remote pre-auth compromise vector.
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user interaction (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is very low at 0.03% (9th percentile), indicating limited real-world targeting despite the high base score. The vendor advisory does not detail the affected feature or protocol, and the product's niche deployment footprint further reduces exposure.