CVE-2025-31991
Improper Rate Limiting in HCL DevOps Velocity Enables Brute-Force
Publication date: 2026-04-13
Last updated on: 2026-04-13
Assigner: HCL Software
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcl | devops_velocity | 5.1.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-307 | The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows brute-force attacks due to improper enforcement of rate limiting on user login attempts. This can lead to unauthorized access or compromise of user accounts.
Such unauthorized access risks can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data against unauthorized access.
However, the provided information does not explicitly state the direct impact on compliance with these regulations.
Can you explain this vulnerability to me?
This vulnerability occurs because the rate limiting mechanism for user login attempts in HCL DevOps Velocity is not properly enforced. As a result, attackers can perform brute-force attacks by repeatedly trying to log in past the limit of unsuccessful login attempts.
This issue is addressed and fixed in version 5.1.7 of HCL DevOps Velocity.
How can this vulnerability impact me? :
The vulnerability allows attackers to perform brute-force attacks on user login credentials, potentially leading to unauthorized access to user accounts.
While the confidentiality of data is not directly impacted (as indicated by the CVSS score), the integrity of the system can be compromised because attackers may gain control over user accounts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade HCL DevOps Velocity to version 5.1.7 where the issue is fixed.