CVE-2025-31954

HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0125011	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltech:dryice_iautomate:6.5.1:::::::*
	cpe:2.3:a:hcltech:dryice_iautomate:6.5.2:::::::*

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL iAutomate v6.5.1 y v6.5.2 es susceptible a una revelación de información sensible. Un método GET HTTP se utiliza para procesar una solicitud e incluye información sensible en la cadena de consulta de esa solicitud. Un atacante podría potencialmente acceder a información o recursos a los que no estaba destinado a ver.

Information

Published : 2025-11-05 19:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-31954

Mitre link : CVE-2025-31954

CVE.ORG link : CVE-2025-31954

JSON object : View

Products Affected

hcltech

dryice_iautomate

CWE

CWE-598

Use of HTTP Request With Sensitive Query String

{"id": "CVE-2025-31954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31954", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-05T18:46:39.807561Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "iAutomate", "versions": [{"status": "affected", "version": "6.5.1, 6.5.2"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-05T19:15:51.010", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0125011", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-598"}]}], "descriptions": [{"lang": "en", "value": "HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see."}, {"lang": "es", "value": "HCL iAutomate v6.5.1 y v6.5.2 es susceptible a una revelaci\u00f3n de informaci\u00f3n sensible. Un m\u00e9todo GET HTTP se utiliza para procesar una solicitud e incluye informaci\u00f3n sensible en la cadena de consulta de esa solicitud. Un atacante podr\u00eda potencialmente acceder a informaci\u00f3n o recursos a los que no estaba destinado a ver."}], "lastModified": "2026-10-18T21:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:dryice_iautomate:6.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44673058-EA8C-479D-9913-453FA6B5C110"}, {"criteria": "cpe:2.3:a:hcltech:dryice_iautomate:6.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AAB9E02F-8C2B-4BD5-A505-903CFFF5D811"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}