A vulnerability in HCL AION allows pages served over HTTPS to be cached by browsers or intermediate proxies. Sensitive information contained in those responses can be retrieved by an unauthorized user who has access to the cache, potentially resulting in unintended behavior or security impact when the data is exposed.

HCL Software’s HCL AION product is affected. No specific version details are provided, so all installations of HCL AION should be treated as potentially vulnerable unless they have been patched or configuration changes applied.

The CVSS score of 3.7 indicates low to medium severity, but no EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. An attacker would need physical or network access to the browser or proxy cache that has stored the HTTPS response. The risk is limited to scenarios where such caches are accessible and contain sensitive data; no special privileges or credentials are required beyond cache access.