CVE-2025-55274

HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they could steal sensitive data, perform actions on behalf of a legitimate user.

CVSS v3 2.6 LOW

2.6^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:*:*:*:*:*:*:*

History

17 Jun 2026, 09:41

Type	Values Removed	Values Added
Summary		(es) HCL Aftermarket DPC está afectado por la vulnerabilidad de Cross-Origin Resource Sharing. Las malas configuraciones de CORS incluyen la exposición de información sensible del usuario a atacantes, acceso no autorizado a APIs y posible manipulación o fuga de datos. Si un atacante explotara una mala configuración de CORS, podrían robar datos sensibles, realizar acciones en nombre de un usuario legítimo.

26 Mar 2026, 20:19

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:::::::*
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 - Vendor Advisory
First Time		Hcltech Hcltech aftermarket Cloud

26 Mar 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-26 13:16

Updated : 2026-06-17 09:41

NVD link : CVE-2025-55274

Mitre link : CVE-2025-55274

CVE.ORG link : CVE-2025-55274

JSON object : View

Products Affected

hcltech

aftermarket_cloud

CWE

CWE-942

Permissive Cross-domain Policy with Untrusted Domains

{"id": "CVE-2025-55274", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-55274", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-26T13:43:48.745427Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL", "product": "Aftermarket DPC", "versions": [{"status": "affected", "version": "version 1.0.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-26T13:16:27.033", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-942"}]}], "descriptions": [{"lang": "en", "value": "HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability. CORS misconfigurations includes the exposure of sensitive user information to attackers, unauthorized access to APIs, and possible data manipulation or leakage. If an attacker to exploit CORS misconfiguration, they could steal sensitive data, perform actions on behalf of a legitimate user."}, {"lang": "es", "value": "HCL Aftermarket DPC est\u00e1 afectado por la vulnerabilidad de Cross-Origin Resource Sharing. Las malas configuraciones de CORS incluyen la exposici\u00f3n de informaci\u00f3n sensible del usuario a atacantes, acceso no autorizado a APIs y posible manipulaci\u00f3n o fuga de datos. Si un atacante explotara una mala configuraci\u00f3n de CORS, podr\u00edan robar datos sensibles, realizar acciones en nombre de un usuario leg\u00edtimo."}], "lastModified": "2026-06-17T09:41:33.940", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:aftermarket_cloud:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C71E5E64-ED4C-4763-8A74-5F9DDCFD13DA"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}