CVE-2025-31998

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:unica_centralized_offer_management:*:*:*:*:*:*:*:*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) HCL Unica Centralized Offer Management es vulnerable a excepciones no manejadas deficientemente, lo que expone información sensible. Un atacante puede explotar esta información para explotar vulnerabilidades conocidas y lanzar ataques dirigidos, como la ejecución remota de código o la denegación de servicio.

Information

Published : 2025-10-12 03:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-31998

Mitre link : CVE-2025-31998

CVE.ORG link : CVE-2025-31998

JSON object : View

Products Affected

hcltech

unica_centralized_offer_management

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

CWE-703

Improper Check or Handling of Exceptional Conditions

{"id": "CVE-2025-31998", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31998", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-17T14:37:23.317315Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "Unica Centralized Offer Management", "versions": [{"status": "affected", "version": "<=25.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-12T03:15:34.557", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-209"}, {"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit use this information to exploit known vulnerabilities launch targeted attacks, such as remote code execution or denial of service."}, {"lang": "es", "value": "HCL Unica Centralized Offer Management es vulnerable a excepciones no manejadas deficientemente, lo que expone informaci\u00f3n sensible. Un atacante puede explotar esta informaci\u00f3n para explotar vulnerabilidades conocidas y lanzar ataques dirigidos, como la ejecuci\u00f3n remota de c\u00f3digo o la denegaci\u00f3n de servicio."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:unica_centralized_offer_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5542E4D6-1B72-44F5-8CFF-D31D47444299", "versionEndExcluding": "25.1.0.1"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}