CVE-2025-0272

HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120137	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltechsw:hcl_devops_deploy::::::::
	cpe:2.3:a:hcltechsw:hcl_devops_deploy::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::
	cpe:2.3:a:hcltechsw:hcl_launch::::::::

History

10 Apr 2025, 13:27

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hcltechsw:hcl_devops_deploy:::::::: cpe:2.3:a:hcltechsw:hcl_launch::::::::
CWE		CWE-79
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120137 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120137 - Vendor Advisory
First Time		Hcltechsw Hcltechsw hcl Devops Deploy Hcltechsw hcl Launch

07 Apr 2025, 14:18

Type	Values Removed	Values Added
Summary		(es) HCL DevOps Deploy/HCL Launch es vulnerable a la inyección de HTML. Esta vulnerabilidad podría permitir que un usuario incruste etiquetas HTML arbitrarias en la interfaz web, lo que podría provocar la divulgación de información confidencial.

03 Apr 2025, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-04-03 15:15

Updated : 2025-04-10 13:27

NVD link : CVE-2025-0272

Mitre link : CVE-2025-0272

CVE.ORG link : CVE-2025-0272

JSON object : View

Products Affected

hcltechsw

hcl_launch
hcl_devops_deploy

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-0272", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 2.3}]}, "published": "2025-04-03T15:15:47.560", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120137", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-80"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure."}, {"lang": "es", "value": "HCL DevOps Deploy/HCL Launch es vulnerable a la inyecci\u00f3n de HTML. Esta vulnerabilidad podr\u00eda permitir que un usuario incruste etiquetas HTML arbitrarias en la interfaz web, lo que podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n confidencial."}], "lastModified": "2025-04-10T13:27:02.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltechsw:hcl_devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42A4C3FF-3686-420F-894E-4D51AACEA84B", "versionEndExcluding": "8.0.1.5", "versionStartIncluding": "8.0.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_devops_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "335E9410-E48A-408A-99AB-17C352FECE14", "versionEndExcluding": "8.1.0.1", "versionStartIncluding": "8.1.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EA22CDE-24F0-4272-B8FD-F52E6BB813A3", "versionEndIncluding": "7.0.5.26", "versionStartIncluding": "7.0.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38CF144B-AD62-4D88-BEF5-65CB622A041F", "versionEndExcluding": "7.1.2.22", "versionStartIncluding": "7.1.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B8BBA9A0-5AAA-49CD-B8B5-A4188B4697E1", "versionEndExcluding": "7.2.3.15", "versionStartIncluding": "7.2.0.0"}, {"criteria": "cpe:2.3:a:hcltechsw:hcl_launch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A3836CE-993D-4B8A-B546-D9AD5FD14293", "versionEndIncluding": "7.3.2.9", "versionStartIncluding": "7.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}