Missing Content-Security-Policy in HCL AION Software
CVE-2025-52629

3.7LOW

Key Information:

Vendor

HCL Software
Status
Aion
Vendor
CVE Published:
3 February 2026

What is CVE-2025-52629?

HCL AION, specifically version 2.0, is prone to a vulnerability due to the absence of a Content-Security-Policy (CSP) header. This oversight can significantly heighten the risk of cross-site scripting (XSS) and other content injection attacks, as it permits potentially unsafe scripts or resources to execute. Implementing a CSP is crucial for enhancing the security posture of AION and mitigating these risks.

Affected Version(s)

AION 2.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.