PT-2025-45165 · Hcl · Hcl Devops Loop

Published 2025-11-05 · Updated 2025-11-06 · CVE-2025-55278

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HCL DevOps Loop (affected versions not specified)

Description The API authentication middleware in HCL DevOps Loop does not properly validate authentication tokens, specifically regarding their expiration and cryptographic signature. This could allow an attacker to use expired or tampered tokens to gain unauthorized access to sensitive resources and perform actions with elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Insufficient Session Expiration

Weakness Enumeration

CWE-347

CWE-613

Related Identifiers

CVE-2025-55278

Affected Products

Hcl Devops Loop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-55278 · Security Note
• https://t.me/cveNotify/141882 · Telegram Post
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124203 · Note
• https://t.me/CVEtracker/36654 · Telegram Post