CVE-2025-31997

HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:unica_centralized_offer_management:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) HCL Unica Centralized Offer Management es vulnerable a Referencias Directas Inseguras a Objetos (IDOR). Un atacante puede eludir la autorización y acceder a recursos en el sistema directamente, por ejemplo, registros de la base de datos o archivos.

Information

Published : 2025-10-12 03:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-31997

Mitre link : CVE-2025-31997

CVE.ORG link : CVE-2025-31997

JSON object : View

Products Affected

hcltech

unica_centralized_offer_management

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-31997", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31997", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T14:31:38.423358Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "Unica Centralized Offer Management", "versions": [{"status": "affected", "version": "<=25.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-12T03:15:34.393", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files."}, {"lang": "es", "value": "HCL Unica Centralized Offer Management es vulnerable a Referencias Directas Inseguras a Objetos (IDOR). Un atacante puede eludir la autorizaci\u00f3n y acceder a recursos en el sistema directamente, por ejemplo, registros de la base de datos o archivos."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:unica_centralized_offer_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5542E4D6-1B72-44F5-8CFF-D31D47444299", "versionEndExcluding": "25.1.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}