Executive brief
HCL DFXAnalytics, a data analytics platform, contains a security flaw where session cookies are not properly protected during transmission. This could allow an attacker who is monitoring network traffic to intercept sensitive session tokens or user credentials if they are sent over an unencrypted connection. While the risk is relatively low due to the technical requirements for an exploit, it could lead to unauthorized access to user accounts.
Technical details
HCL DFXAnalytics fails to set the 'secure' attribute on session cookies generated during the authentication process. This vulnerability, classified as CWE-200 (Exposure of Sensitive Information), occurs when the application does not instruct the browser to only transmit cookies over encrypted (HTTPS) channels. A remote attacker positioned to intercept network traffic (e.g., via a man-in-the-middle attack) could capture these cookies if a user's browser sends them over an unencrypted HTTP connection. The vulnerability affects version 3.0 and below; users should refer to HCL Software advisory KB0131787 for remediation steps.
Affected products
- HCL Software DFXAnalytics 3.0 and below
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory