The vulnerability is an insecure security‑header configuration: the Content‑Security‑Policy header in HCL DFXAnalytics does not define strict directives for object‑src and base‑uri. This omission permits an attacker to embed malicious scripts through cross‑site scripting vectors, potentially enabling the execution of unauthorized JavaScript in the active session of legitimate users. The attack could result in theft of session tokens, manipulation of page content, or arbitrary code execution in the context of the user"s privileges.

The affected vendor is HCL and the product is DFXAnalytics. No specific product version or build information was supplied in the advisory.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of < 1% reflects a very low but nonzero probability that the vulnerability will be exploited. The vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is a web‑browser interface, requiring an attacker to provoke a legitimate user to load a malicious URL or embed hostile content within the application. Exploitation would involve client‑side code injection, which could lead to compromise of the victim’s session and data.