CVE-2025-59874
CSP Missing Directives in HCL Hive Telco Observability Keycloak
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: HCL Software
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcl | hive_telco_observability | * |
| keycloak | keycloak | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1027 |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in HCL Hive Telco Observability involves missing required directives in the Content Security Policy (CSP) within the Keycloak component of the web application.
Missing essential CSP directives can leave the site vulnerable by not properly restricting the sources from which content can be loaded, potentially allowing malicious content to be executed.
How can this vulnerability impact me? :
This vulnerability can have a high impact as indicated by the CVSS score of 8.1, with high confidentiality and integrity impacts.
An attacker could exploit the missing CSP directives to execute malicious scripts or content, potentially leading to data breaches or unauthorized actions within the application.