Sensitive Authentication Token Exposure in HCL DevOps Deploy Service
CVE-2025-0273

5.5MEDIUM

Key Information:

Vendor
HCL Software Software
Status
HCL Software Devops Deploy / HCL Software Launch
Vendor
CVE Published:
27 March 2025

Summary

HCL DevOps Deploy and HCL Launch have a vulnerability that allows potentially sensitive authentication tokens to be stored in log files. This could pose a risk as local users may have access to these log files, leading to unauthorized usage of sensitive information. Proper handling and safeguarding of log files are essential to mitigate this risk.

Affected Version(s)

HCL DevOps Deploy / HCL Launch 7.0 - 7.0.5.26; 7.1 - 7.1.2.21; 7.2 - 7.2.3.14; 7.3 - 7.3.2.9; 8.0 - 8.0.1.4; 8.1 - 8.1.0.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.