CVE-2025-62318
Received Received - Intake

BaseFortify

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: HCL Software

Description
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2025-62318
EUVD
EUVD-2025-210724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl aion *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

HCL AION has a vulnerability where JavaScript responses with data can be referenced by external pages. This may let an attacker-controlled page capture sensitive information through JavaScript hijacking under specific conditions.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal sensitive data exposed in JavaScript responses. This might include user information, session tokens, or other confidential details depending on the application's data handling.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR (data protection) and HIPAA (health information privacy) by allowing access to sensitive personal or health data. Compliance risks include fines and legal penalties.

Mitigation Strategies

Implement Content Security Policy (CSP) headers to restrict external JavaScript references. Ensure sensitive data is not exposed in JavaScript responses. Validate and sanitize all user inputs and API responses to prevent data leakage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-62318. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart