9.8
CVE-2026-56453
- EPSS 0.19%
- Veröffentlicht 16.07.2026 13:06:49
- Zuletzt bearbeitet 17.07.2026 19:09:35
- Erkennungen
LoginHCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability.
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hcltech ≫ Dfxanalytics Version <= 3.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.084 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
| psirt@hcl.com | 5.5 | 1.3 | 3.7 |
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
|
CWE-294 Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787