CVE-2025-31954CWE-598

CVE-2025-31954

Medium · published November 6, 2025

CVSS v3.1
5.4
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that request. An attacker could potentially access information or resources they were not intended to see.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.8th percentile
Weakness
CWE-598 · Use of HTTP Request With Sensitive Query String
Published
2025-11-06T00:15Z
Affected products (2)
ProductVersionsFixed in
hcltech/dryice_iautomateall versions—
hcltech/dryice_iautomateall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0125011 · [email protected]
EPSS history
Timeline
  • 05 NOV 18:23Z
    HCL iAutomate is susceptible to a sensitive information disclosure
    cvelistv5