Executive brief
HCL DFXAnalytics, a data analytics platform, is vulnerable to a security flaw that could allow an attacker to take over user accounts. By intercepting and modifying the data sent from the server to a user's browser, an attacker can trick the application into granting unauthorized access. This could lead to the exposure of sensitive analytics data or unauthorized actions performed on behalf of legitimate users.
Technical details
HCL DFXAnalytics (version 3.0 and below) is vulnerable to account takeover via response manipulation (CWE-294). A remote attacker with low privileges can intercept and alter HTTP responses from the server before they reach the client-side application. By modifying the authentication or authorization logic contained within these responses, the attacker can bypass security controls to gain unauthorized access to targeted user accounts. This attack requires high complexity (AC:H) and user interaction (UI:R), typically involving a man-in-the-middle (MitM) position or similar interception capability. HCL has addressed this in their security bulletin KB0131787.
Affected products
- HCL Software DFXAnalytics 3.0 and below
Timeline
- 2026-07-16: disclosed
- 2026-07-16: advisory