CVE-2025-52614

HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site.

CVSS v3 3.5 LOW

3.5^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) HCL Unica Platform está afectada por una vulnerabilidad de cookie sin la bandera HTTPOnly establecida. Un agente malicioso podría inducir este evento al proporcionar a un usuario enlaces adecuados, ya sea directamente o a través de otro sitio web.

Information

Published : 2025-10-12 08:15

Updated : 2026-10-08 13:10

NVD link : CVE-2025-52614

Mitre link : CVE-2025-52614

CVE.ORG link : CVE-2025-52614

JSON object : View

Products Affected

hcltech

unica

CWE

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

{"id": "CVE-2025-52614", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52614", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T14:31:23.053580Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "Unica Platform", "versions": [{"status": "affected", "version": "<= 25.1"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-12T08:15:40.373", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124417", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-614"}]}], "descriptions": [{"lang": "en", "value": "HCL Unica Platform is affected by a Cookie without HTTPOnly Flag Set vulnerability. A malicious agent may be able to induce this event by feeding a user suitable links, either directly or via another web site."}, {"lang": "es", "value": "HCL Unica Platform est\u00e1 afectada por una vulnerabilidad de cookie sin la bandera HTTPOnly establecida. Un agente malicioso podr\u00eda inducir este evento al proporcionar a un usuario enlaces adecuados, ya sea directamente o a trav\u00e9s de otro sitio web."}], "lastModified": "2026-10-08T13:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B287D9C3-B8E1-4988-864C-855E14105538", "versionEndIncluding": "25.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}