CVE-2025-62318
LowCVSS 3.7Summary
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.
Risk Assessment
The risk includes potential disclosure of sensitive data to a third party, which can lead to confidentiality breach and data theft. An attacker can exploit this vulnerability to intercept information transmitted in JavaScript responses.
Recommendation
It is recommended to upgrade HCL AION to the latest version containing the fix. Also consider adding security headers such as X-Content-Type-Options and Content-Security-Policy to prevent JavaScript hijacking.
Original NVD description (English source)
HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page (JavaScript hijacking) under certain conditions.