Dfxanalytics
Monthly
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP responses to defeat client-side authentication or authorization checks and gain unauthorized access to targeted user accounts. HCL rated the flaw critical (CVSS 9.8), but there is no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile), with CISA's SSVC framework marking exploitation as none and technical impact as only partial. The weakness class is authentication bypass (CWE-294), where trust in unverified/manipulable response data lets an attacker forge an authenticated state.
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any locally authenticated non-administrative user to overwrite or replace those binaries with malicious code. When a privileged user subsequently runs the tampered installer - during installation, upgrade, or reinstallation - the attacker's binary executes in the elevated context, completing a local privilege escalation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the vendor-reported CVSS 3.3 score materially understates the potential impact of a successful exploitation scenario.
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Security Policy, allowing attackers with low privileges to potentially exploit browser-specific XSS protections or bypass intended security controls. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation but indicating security posture degradation in a production analytics platform.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers with high effort to gain limited unauthorized access. The application fails to update or isolate vulnerable dependencies, potentially enabling exploitation of publicly disclosed security flaws in embedded components to bypass authentication or extract sensitive information.
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.
Denial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the application by supplying oversized input that overflows a fixed-size memory buffer. The flaw stems from missing input-length validation and carries an availability-only impact (CVSS 7.5, AV:N/PR:N); there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.24%), though CISA SSVC rates the weakness as automatable with partial technical impact.
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP responses to defeat client-side authentication or authorization checks and gain unauthorized access to targeted user accounts. HCL rated the flaw critical (CVSS 9.8), but there is no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile), with CISA's SSVC framework marking exploitation as none and technical impact as only partial. The weakness class is authentication bypass (CWE-294), where trust in unverified/manipulable response data lets an attacker forge an authenticated state.
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedded within the application's server responses, allowing a remote unauthenticated attacker to enumerate internal infrastructure for reconnaissance. The issue was reported by HCL and carries a vendor CVSS of 8.2, though it maps to a CWE-200 information exposure with no integrity or availability impact. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and CISA SSVC rates exploitation as none and non-automatable.
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are issued without the 'secure' attribute, permitting the browser to transmit them over unencrypted HTTP. A network-positioned attacker able to observe or coerce cleartext traffic can capture session tokens or credentials and impersonate the victim. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC records no known exploitation.
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any locally authenticated non-administrative user to overwrite or replace those binaries with malicious code. When a privileged user subsequently runs the tampered installer - during installation, upgrade, or reinstallation - the attacker's binary executes in the elevated context, completing a local privilege escalation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the vendor-reported CVSS 3.3 score materially understates the potential impact of a successful exploitation scenario.
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system logs, or debugging output rendered by the application dashboard. All versions are affected per the wildcard CPE, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated remote attackers can trivially trigger and read this disclosure with no special configuration. No public exploit code exists and the vulnerability is not listed in CISA KEV; however, the leaked path information materially aids reconnaissance for chained attacks against the underlying server environment.
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attacks by network-positioned adversaries. All versions per the CPE wildcard are affected, and the application fails to include the Strict-Transport-Security response header, leaving browsers without enforcement of HTTPS-only communication. No active exploitation has been identified (not in CISA KEV) and no public exploit code is known, consistent with the low CVSS score of 3.1.
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication are issued without the SameSite attribute, allowing browsers to attach them to cross-origin requests. An attacker who can lure an authenticated victim to a malicious page may issue forged state-changing requests that the server honors under the victim's identity, provided the application also lacks Anti-CSRF token validation - a condition the CVE description explicitly names as the decisive amplifying factor. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; real-world risk is further constrained by modern browser defaults (Chrome 80+ and Firefox apply SameSite=Lax by default), high attack complexity, and the required user interaction.
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.
HCL DFXAnalytics relies on the obsolete X-XSS-Protection security header instead of implementing a modern Content Security Policy, allowing attackers with low privileges to potentially exploit browser-specific XSS protections or bypass intended security controls. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation but indicating security posture degradation in a production analytics platform.
HCL DFXAnalytics exposes detailed stack traces in application responses due to improper error handling, allowing authenticated remote attackers with low privileges to gain insights into the application's internal structure, code logic, and environment configurations. The vulnerability requires high attack complexity and produces limited confidentiality impact, resulting in a CVSS score of 3.1. No active exploitation or public exploit code has been identified at the time of analysis.
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers with high effort to gain limited unauthorized access. The application fails to update or isolate vulnerable dependencies, potentially enabling exploitation of publicly disclosed security flaws in embedded components to bypass authentication or extract sensitive information.
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling attackers to inject and execute arbitrary scripts through cross-site scripting (XSS) vectors without authentication or user interaction. This network-accessible vulnerability affects all versions and results in information disclosure with a CVSS score of 5.3; no active exploitation has been reported.