CVE-2026-35140

7.2 Élevée

Publiée le 16/07/2026 à 16:16 · Modifiée le 17/07/2026 à 19:00 · Analysée par le NVD · Source : psirt@hcl.com

Description

HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability. The application fails to set the "secure" attribute on session cookies generated during authentication, which could allow a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.

Traduire en français

Produits concernés

HCL Software DFXAnalytics
Hcltech dfxanalytics

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.0 Faible	psirt@hcl.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N`
3.1	7.2 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-200

Références

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories