Icontrol
Monthly
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session tokens valid indefinitely until explicit logout. An attacker who obtains a valid session token - through interception or unattended browser access - can reuse it to access the application and read data. CVSS rates this Low (3.1) reflecting high attack complexity and limited confidentiality impact; no public exploit exists and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized input that executes when a victim clicks a crafted link or opens an exported CSV report. Insufficient sanitization of input parameters (CWE-1236) allows malicious script or spreadsheet formulas to run in the victim's browser or spreadsheet application. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), indicating negligible observed exploitation activity.
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via unhandled JavaScript exceptions. The application fails to catch a runtime error when attempting to read the 'dashboard' key from an undefined object, returning a full stack trace to the requesting client. No public exploit exists and no active exploitation has been observed; CVSS scores this Low (3.1), reflecting strictly limited confidentiality impact with no integrity or availability consequences.
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS filtering mechanisms, creating an exploitable gap classified under CWE-693 (Protection Mechanism Failure). The flaw is network-accessible and requires no authentication (PR:N per CVSS), but carries a CVSS 3.7 Low score due to high attack complexity (AC:H) and limited integrity-only impact (I:L). No public exploit code exists and this vulnerability is not listed in CISA KEV, placing it in the compliance/hardening category rather than immediate critical risk.
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to root, enabling network-adjacent attackers with authenticated sessions to perform limited integrity modifications under high-complexity conditions. The missing Secure attribute allows cookies to be transmitted over unencrypted HTTP channels, while the absent SameSite attribute opens a cross-site request forgery vector. CVSS scores this at 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resulting in limited integrity impact against the target system. The vulnerability stems from an implementation deficiency in an architectural security tactic - specifically, the application's failure to correctly validate received input against its expected type. No public exploit code exists and no active exploitation has been confirmed; however, the low-complexity, network-accessible attack vector lowers the bar for authenticated users to abuse this flaw.
Broken access control in HCL iControl (CVSS 3.1 score 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) allows a low-privileged authenticated user to bypass authorization checks or manipulate object identifiers directly, resulting in privilege escalation and unauthorized modification or deletion of sensitive application data. Because the exploit requires a valid low-privilege account (PR:L), an unauthenticated external attacker cannot exploit this despite the 'Authentication Bypass' tag on the report, but any user with even minimal credentials can escalate to full confidentiality, integrity, and availability impact without user interaction. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; prioritization should focus on environments where low-privilege accounts are broadly provisioned or externally reachable.
Insufficient session expiration in HCL iControl allows anyone who reaches a legitimate user's still-valid session to operate inside the application as that user, because the product does not enforce an adequate session timeout for unattended or abandoned sessions. Practical risk is low by every available signal: exploitation requires a victim to authenticate and then leave the session live on a shared, unlocked, or physically accessible workstation or an unterminated browser, and the independent assessment rates this AV:L/AC:H/PR:N with only low confidentiality and integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, EPSS/KEV data is absent, and the only published reference is the vendor advisory (HCL KB0133940); note that the vendor's own AV:N/PR:L vector overstates the reach of what is fundamentally a local or shared-workstation attack.
Session cookie interception in HCL iControl allows an on-path attacker to capture sensitive information such as session identifiers when the Secure attribute is missing and cookies are transmitted over unencrypted HTTP. Exploitation requires a victim with an authenticated session, transmission of the cookie over HTTP, and the attacker to occupy a man-in-the-middle position; no public exploit or active exploitation has been identified. This is a low-priority information disclosure issue (CVSS 3.1) with confidentiality-only impact.
Improper error handling in HCL iControl causes verbose database and system error output to be returned to whoever triggers an unhandled input path, disclosing internal infrastructure details (hostnames, schema or driver information, filesystem paths) that are useful for reconnaissance and planning follow-on attacks. The issue carries a low CVSS v3.1 base score of 3.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) - vendor scoring, with our independent assessment re-scoring it slightly higher in attack prerequisites (PR:N) while agreeing on scope and confidentiality-only impact - meaning the exposure is informational and there is no integrity or availability effect. Authentication requirements are not definitively confirmed: the CVSS vector encodes PR:L (a valid low-privileged account) while the vendor description and our assessed vector (PR:N) imply the error disclosure may be reachable without credentials, so defenders should validate which path applies in their deployment. There is no KEV listing and no public exploit identified at time of analysis, so this is a genuinely low-priority issue by every available signal and does not warrant emergency response.
Insecure cross-origin resource sharing (CORS) configuration in HCL iControl allows an attacker-controlled website to issue credentialed cross-origin requests against the product, letting the attacker read and exfiltrate sensitive data that is reachable within a victim's authenticated browser session. The vendor scores this 4.3 (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), while independent assessment also rates it 4.3 but with AV:N/AC:L/PR:N/UI:R - reflecting that although the attacker needs no server-side credentials of their own, the victim must be authenticated to iControl and must be lured to the attacker's page, so the practical prerequisite is user interaction rather than attacker authentication. Impact is confined to confidentiality (read/exfiltration; no integrity or availability effect), and no public exploit code or CISA KEV entry has been identified at time of analysis.
HCL iControl's web interface fails to automatically expire user sessions after inactivity, leaving authenticated session tokens valid indefinitely until explicit logout. An attacker who obtains a valid session token - through interception or unattended browser access - can reuse it to access the application and read data. CVSS rates this Low (3.1) reflecting high attack complexity and limited confidentiality impact; no public exploit exists and the vulnerability is not listed in CISA KEV.
Reflected cross-site scripting and CSV formula injection in HCL iControl 4.0.0 let a remote attacker embed unsanitized input that executes when a victim clicks a crafted link or opens an exported CSV report. Insufficient sanitization of input parameters (CWE-1236) allows malicious script or spreadsheet formulas to run in the victim's browser or spreadsheet application. No public exploit identified at time of analysis, and EPSS is very low (0.04%, 13th percentile), indicating negligible observed exploitation activity.
Stack trace disclosure in HCL iControl v4.0.0 exposes internal application details to authenticated remote attackers via unhandled JavaScript exceptions. The application fails to catch a runtime error when attempting to read the 'dashboard' key from an undefined object, returning a full stack trace to the requesting client. No public exploit exists and no active exploitation has been observed; CVSS scores this Low (3.1), reflecting strictly limited confidentiality impact with no integrity or availability consequences.
Missing HTTP security response headers in HCL iControl fail to instruct client browsers to engage their built-in XSS filtering mechanisms, creating an exploitable gap classified under CWE-693 (Protection Mechanism Failure). The flaw is network-accessible and requires no authentication (PR:N per CVSS), but carries a CVSS 3.7 Low score due to high attack complexity (AC:H) and limited integrity-only impact (I:L). No public exploit code exists and this vulnerability is not listed in CISA KEV, placing it in the compliance/hardening category rather than immediate critical risk.
HCL iControl exposes session cookies without the Secure or SameSite attributes set, and with the cookie path scoped to root, enabling network-adjacent attackers with authenticated sessions to perform limited integrity modifications under high-complexity conditions. The missing Secure attribute allows cookies to be transmitted over unencrypted HTTP channels, while the absent SameSite attribute opens a cross-site request forgery vector. CVSS scores this at 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Weak input validation in HCL iControl allows authenticated remote attackers to submit input of an unexpected type, resulting in limited integrity impact against the target system. The vulnerability stems from an implementation deficiency in an architectural security tactic - specifically, the application's failure to correctly validate received input against its expected type. No public exploit code exists and no active exploitation has been confirmed; however, the low-complexity, network-accessible attack vector lowers the bar for authenticated users to abuse this flaw.