CVE-2025-62330
Cleartext Transmission Vulnerability in HCL DevOps Deploy Exposes Credentials
Publication date: 2025-12-16
Last updated on: 2025-12-16
Assigner: HCL Software
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcl | devops_deploy | 3.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in HCL DevOps Deploy occurs because the HTTP port remains accessible and does not redirect to HTTPS as intended. This allows sensitive information, such as user credentials and session data, to be transmitted in cleartext. An attacker with network access could intercept or modify this information through passive monitoring or man-in-the-middle attacks. [1]
How can this vulnerability impact me? :
The vulnerability can lead to interception or modification of sensitive information like user credentials and session data by attackers with network access. This can result in unauthorized access to user accounts or sessions, potentially compromising the security of the system and user data. [1]