CVE-2026-35145

Analyzed Analyzed - Analysis Complete

Missing HSTS Header in HCL DFXAnalytics

Publication date: 2026-07-16

Last updated on: 2026-07-17

Assigner: HCL Software

Description

HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerability. The application fails to implement the HTTP Strict Transport Security (HSTS) policy within its responses, which could allow a remote attacker to downgrade the communication channel to an unencrypted connection (HTTP) and conduct man-in-the-middle (MitM) attacks. To remediate this, the application must include the "Strict-Transport-Security" header in all web application responses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-04

NVD

CVE-2026-35145

EUVD

EUVD-2026-44920

Affected Vendors & Products

Vendor	Product	Version / Range
hcltech	dfxanalytics	to 3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

HCL DFXAnalytics has a Missing HTTP Strict-Transport-Security Header vulnerability. This means the application does not enforce HTTPS by default through the HSTS policy. Attackers could exploit this to downgrade connections to unencrypted HTTP and intercept or manipulate data via man-in-the-middle attacks.

Detection Guidance

To detect the missing HTTP Strict-Transport-Security header in HCL DFXAnalytics, use tools like curl to check HTTP responses. Run: curl -I http://your-server-address. If the response lacks the 'Strict-Transport-Security' header, the vulnerability exists.

Impact Analysis

This vulnerability allows attackers to intercept unencrypted communications, potentially stealing sensitive data or altering it during transmission. Users may face data breaches, unauthorized access, or loss of data integrity without realizing their connection was compromised.

Compliance Impact

This vulnerability likely violates requirements for encrypted data transmission in GDPR and HIPAA. Both regulations mandate strong security measures to protect personal and health data. Failure to implement HSTS could result in non-compliance, legal penalties, or loss of certification.

Mitigation Strategies

Immediately configure the application to include the 'Strict-Transport-Security' header in all web responses. Ensure HTTPS is enforced and the header is set with appropriate directives like 'max-age=31536000; includeSubDomains'.

Hi! I’m here to help you understand CVE-2026-35145. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70