HCL DFXAnalytics implements an improper error handling mechanism that reveals full stack traces in HTTP responses. The disclosed stack traces expose internal class names, file paths, configuration values, and application logic. Although the vulnerability does not provide direct control over the system, the detailed information can aid an attacker in mapping the application’s architecture and identifying potential follow‑on weaknesses such as entry points for injection or misconfigured services.

The affected product is HCL DFXAnalytics. No specific version ranges are listed in the CNA data; all installations of the product are therefore potentially impacted unless a later release removed the error detail feature.

The CVSS score of 3.1 signals a low‑severity risk. The lack of an EPSS score and absence from the CISA KEV catalog indicate that there is no evidence of active exploitation at the time of this analysis. However, the vulnerability can be triggered remotely via HTTP requests, as the stack traces appear in responses to client errors. An attacker only needs to send a request that causes an error; the application will then return the stack trace, providing valuable insight into the system’s internals.