CVE-2025-62330
Unknown Unknown - Not Provided
Cleartext Transmission Vulnerability in HCL DevOps Deploy Exposes Credentials

Publication date: 2025-12-16

Last updated on: 2025-12-16

Assigner: HCL Software

Description
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-16
Last Modified
2025-12-16
Generated
2026-06-16
AI Q&A
2025-12-16
EPSS Evaluated
2026-06-14
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hcl devops_deploy 3.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in HCL DevOps Deploy occurs because the HTTP port remains accessible and does not redirect to HTTPS as intended. This allows sensitive information, such as user credentials and session data, to be transmitted in cleartext. An attacker with network access could intercept or modify this information through passive monitoring or man-in-the-middle attacks. [1]

Impact Analysis

The vulnerability can lead to interception or modification of sensitive information like user credentials and session data by attackers with network access. This can result in unauthorized access to user accounts or sessions, potentially compromising the security of the system and user data. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart