CVE-2025-31991

Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130138	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:devops_velocity:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) La limitación de tasa para los intentos de inicio de sesión de usuario no se está aplicando correctamente, haciendo que HCL DevOps Velocity sea susceptible a ataques de fuerza bruta más allá del límite de intentos de inicio de sesión fallidos. Esta vulnerabilidad está corregida en 5.1.7.

Information

Published : 2026-04-13 16:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-31991

Mitre link : CVE-2025-31991

CVE.ORG link : CVE-2025-31991

JSON object : View

Products Affected

hcltech

devops_velocity

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2025-31991", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31991", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T17:07:08.674988Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "Velocity", "versions": [{"status": "affected", "version": "<.5.1.7"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-13T16:16:24.110", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130138", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit.\u00a0 This vulnerability is fixed in 5.1.7."}, {"lang": "es", "value": "La limitaci\u00f3n de tasa para los intentos de inicio de sesi\u00f3n de usuario no se est\u00e1 aplicando correctamente, haciendo que HCL DevOps Velocity sea susceptible a ataques de fuerza bruta m\u00e1s all\u00e1 del l\u00edmite de intentos de inicio de sesi\u00f3n fallidos. Esta vulnerabilidad est\u00e1 corregida en 5.1.7."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:devops_velocity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A0B08191-79B5-4DB6-AE9B-43F5D6062A07", "versionEndExcluding": "5.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}