CVE-2025-52628mediumCWE-1275

CVE-2025-52628: medium-severity vulnerability in HCL AION

HCL AION is susceptible to Missing SameSite vulnerability

Published

Follow this CVE+ Monitor AION

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.2%
In short

HCL AION 2.0 doesn't properly protect cookies from being sent in cross-site requests, which can allow attackers to trick users into performing unwanted actions on their accounts.

Technical detail

The application fails to set the SameSite attribute on cookies, allowing them to be transmitted in cross-site requests. This enables Cross-Site Request Forgery (CSRF) attacks where an attacker can forge requests on behalf of authenticated users. The vulnerability affects AION 2.0 and requires user interaction through a malicious third-party site.

Summary generated and translated by AI from the official description.
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Affected products
HCL · AION
Related CVEs — HCL AION

In the same product, most dangerous first.

CVE-2025-52626MEDIUMHCL AION is susceptible to Potential Command Injection vulnerabilityEPSS 0.7%CVE-2025-52635LOWHCL AION is susceptible to Trusted types in scripts not enforced in CSPEPSS 0.3%CVE-2025-52631LOWHCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability.EPSS 0.2%CVE-2025-52637MEDIUMMultiple security vulnerabilities affect HCL AIONEPSS 0.2%CVE-2025-52625LOWHCL AION is susceptible to Cacheable SSL Page Found vulnerabilityEPSS 0.2%CVE-2025-52630LOWHCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerabilityEPSS 0.2%