CVE-2025-55271

HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:*:*:*:*:*:*:*

History

17 Jun 2026, 09:41

Type	Values Removed	Values Added
Summary		(es) HCL Aftermarket DPC está afectado por una vulnerabilidad de división de respuesta HTTP donde, dependiendo de cómo la aplicación web maneje la respuesta dividida, un atacante podría ser capaz de ejecutar comandos arbitrarios o inyectar contenido malicioso en la respuesta.

26 Mar 2026, 20:31

Type	Values Removed	Values Added
First Time		Hcltech Hcltech aftermarket Cloud
CPE		cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:::::::*
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 - Vendor Advisory

26 Mar 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-26 13:16

Updated : 2026-06-17 09:41

NVD link : CVE-2025-55271

Mitre link : CVE-2025-55271

CVE.ORG link : CVE-2025-55271

JSON object : View

Products Affected

hcltech

aftermarket_cloud

CWE

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2025-55271", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55271", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T13:41:59.276926Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL", "product": "Aftermarket DPC", "versions": [{"status": "affected", "version": "version 1.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-26T13:16:26.567", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response.."}, {"lang": "es", "value": "HCL Aftermarket DPC est\u00e1 afectado por una vulnerabilidad de divisi\u00f3n de respuesta HTTP donde, dependiendo de c\u00f3mo la aplicaci\u00f3n web maneje la respuesta dividida, un atacante podr\u00eda ser capaz de ejecutar comandos arbitrarios o inyectar contenido malicioso en la respuesta."}], "lastModified": "2026-06-17T09:41:33.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C71E5E64-ED4C-4763-8A74-5F9DDCFD13DA"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}