CVE-2025-31997CWE-639

CVE-2025-31997

Medium · published October 12, 2025

CVSS v3.1
4.2
EPSS
0%
Percentile
12.3
In the wild
Unconfirmed
What it is

HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00224 · 12.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-10-12T07:15Z
Affected products (1)
ProductVersionsFixed in
hcltech/unica_centralized_offer_management< 25.1.0.125.1.0.1
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124422 · [email protected]
EPSS history
Timeline
  • 12 OCT 02:27Z
    HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR)
    cvelistv5