Hcl Hive
Monthly
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.
Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published.
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTTP methods, request/response schemas, and operational surface without access controls. While no credentials or PII are directly disclosed per the vendor's assessment, the exposed documentation materially reduces the reconnaissance effort required for follow-on attacks against the API. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the lower-priority tier despite its network-accessible nature.
Incorrect default permissions in HCL Hive 1.0 expose containerized deployments to unauthorized lateral movement, container breakout, and interception of sensitive inter-service communications by network-accessible attackers requiring no authentication. The flaw (CWE-276) means the platform ships with overly permissive defaults - not a misconfiguration by the operator - making any default deployment potentially vulnerable without additional hardening. No public exploit code exists at time of analysis, and the vulnerability has not been added to the CISA KEV catalog, but the combination of a network-accessible vector, no authentication requirement, and high confidentiality impact warrants prompt remediation.
Unauthorized system access in HCL Hive results from the product bundling third-party components that contain publicly documented security flaws. All tracked versions (CPE: cpe:2.3:a:hclsoftware:hcl_hive:*:*:*:*:*:*:*:*) are potentially affected, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that remote, unauthenticated attackers can reach the vulnerability without user interaction. The Authentication Bypass tag indicates the inherited component flaw enables circumvention of access controls with high confidentiality impact; no active exploitation has been confirmed by CISA KEV at time of analysis.
HCL Hive 1.0 exposes its authentication endpoint without rate limiting, enabling unauthenticated remote attackers to conduct brute-force or credential stuffing attacks that can lead to unauthorized account access, or to flood the endpoint causing a denial of service. Classified under CWE-307 (Improper Restriction of Excessive Authentication Attempts), the flaw requires no privileges or user interaction and is network-accessible against default deployments. No public exploit code or active exploitation has been identified at time of analysis, but the attack class is trivially automated with widely available tooling.
Insufficient access control granularity in HCL Hive's Keycloak IAM instance exposes protected resources to unauthenticated or unauthorized network attackers. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is remotely exploitable without credentials or user interaction against the IAM layer, resulting in unauthorized read access to confidential resources. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor knowledge base article (KB0131731) has been published.
HCL Hive employs a risky cryptographic primitive (CWE-1240) that creates systemic trust failure across the platform: if any single internal component is compromised, an attacker can exploit the weak cryptographic construction to achieve unauthorized lateral movement or harvest credentials at scale. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates the flaw is reachable over the network without authentication, though high attack complexity caps opportunistic risk. No public exploit code or active exploitation has been identified at time of analysis.
Broken access control in HCL Hive 1.0 allows a high-privileged network attacker to bypass code verification gates and introduce unverified, malicious, or broken code directly into production environments. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity, and availability impact against the vulnerable system, contingent on high-privilege access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
HCL Hive exposes its Swagger API documentation publicly to unauthenticated users, revealing API endpoint structures, HTTP methods, request/response schemas, and operational surface without access controls. While no credentials or PII are directly disclosed per the vendor's assessment, the exposed documentation materially reduces the reconnaissance effort required for follow-on attacks against the API. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, placing it in the lower-priority tier despite its network-accessible nature.