PT-2025-45150 · Hcl · Hcl Iautomate

Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-31954

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL iAutomate versions 6.5.1 through 6.5.2

Description HCL iAutomate versions 6.5.1 and 6.5.2 have a sensitive information disclosure issue. The application uses an HTTP GET method to process requests, including sensitive information within the query string. This could allow an attacker to access unintended information or resources. The vulnerable request uses the ''/'' API endpoint with sensitive data in the query string. The parameter query string contains the sensitive information.

Recommendations Update HCL iAutomate to a version newer than 6.5.2.

Fix

Weakness Enumeration

CWE-598

Related Identifiers

CVE-2025-31954

Affected Products

Hcl Iautomate

References · 4

• https://osv.dev/vulnerability/CVE-2025-31954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31954 · Security Note
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0125011 · Vendor Advisory
• https://t.me/CVEtracker/36637 · Telegram Post