HCL iControl omitted critical HTTP security headers, causing modern browsers to rely on their built‑in XSS protection. This creates a cross‑site scripting flaw that permits an attacker to inject scripts into pages served by the application. The vulnerability does not directly compromise data confidentiality or integrity, but it enables attackers to execute arbitrary JavaScript in the victim’s browser, which can lead to session hijacking or credential theft.

The issue is present in all installations of the HCL iControl product that do not ship the missing headers. No specific version numbers are listed, so any deployed instance is potentially vulnerable until a patch or configuration fix is applied.

The CVSS score of 3.7 classifies the flaw as low‑to‑moderate in severity. EPSS data is not available, and the vulnerability is not included in the CISA KEV catalog, indicating no confirmed exploitation in the wild. The likely attack vector is an unauthenticated or authenticated access to the web interface that serves content from iControl; since security headers are absent, browsers cannot apply mitigations, making exploitation relatively straightforward for an attacker who can supply crafted input. This assessment is inferred from the description and the nature of missing headers.