HCL DFXAnalytics suffers from an insecure Security‑Header configuration: the Content‑Security‑Policy header omits strict directives for object-src and base-uri. This omission permits attackers to inject malicious scripts via cross‑site scripting vectors, potentially enabling the execution of unauthorized JavaScript in the context of legitimate users. The consequence could be compromise of user session data, theft of sensitive information, or defacement of displayed content.

The affected vendor is HCL, product DFXAnalytics. No specific version information was supplied in the advisory.

The CVSS score of 5.3 indicates moderate severity. While no EPSS score is available, the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is web‑browser based, requiring an attacker to compel a user to load a malicious URL or content within the application. Exploitation would involve client‑side code injection, which could lead to privilege escalation if the victim has administrative privileges within the system.