Iem
Monthly
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user logs out or an account is deleted, allowing an attacker who has previously captured a legitimate session token to replay it and maintain unauthorized access beyond the intended session lifecycle. The root cause is CWE-613 (Insufficient Session Expiration), where server-side session records are not destroyed upon logout or account removal. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.4 Medium score reflects meaningful constraints on exploitation including high attack complexity and required user interaction.
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the application to unauthorized cross-origin browser interactions. The CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N vector indicates that a highly privileged IEM user must be socially engineered into visiting a malicious page while authenticated, allowing an attacker's script to read IEM responses or issue limited requests on the victim's behalf. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to access resources beyond their original authorization boundary, achieving confidentiality impact against protected data. The vulnerability is classified as CWE-272 (Least Privilege Violation) with a Changed scope in CVSS, indicating the attacker can reach resources outside their normal privilege domain within the application. No public exploit code or active exploitation has been identified at time of analysis; the EPSS signal was not provided.
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user to perform workflow actions that are not captured in security logs, breaking observability for incident response teams. All versions of IEM are affected per the wildcard CPE, and the CVSS Scope:Changed metric indicates the logging gap propagates impact to downstream audit platforms or SIEMs that depend on IEM event data. No public exploit code exists and CISA has not listed this in the KEV catalog; the primary risk is forensic and compliance-oriented rather than direct system compromise.
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privilege boundaries and conduct reconnaissance without generating detectable log entries. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms any low-privileged authenticated user can exploit this over the network with no complexity barrier. No public exploit code or active exploitation has been identified; this is a vendor-self-reported issue with no EPSS data or KEV listing.