Technical impact
The vulnerability is a missing SameSite attribute on session cookies generated during authentication, which can allow a remote attacker to perform Cross‑Site Request Forgery (CSRF) attacks. An attacker who can embed malicious content in a victim’s browser could cause the victim’s authenticated browser to perform unintended requests against the application, potentially altering data or changing the user’s state. The weakness is a missing protection that should prevent cross‑origin cookie usage, thus compromising integrity and potentially confidentiality of the user's actions.
Affected Systems
The affected system is HCL DFXAnalytics, a product of HCL Software. The vulnerability applies to any version that fails to set the SameSite attribute on session cookies during authentication. No specific affected versions are provided in the CNA data; the issue is present in any deployment where the application does not specify a SameSite value for its session cookies.
Risk and Exploitability
The CVSS score of 3 indicates a low severity rating. The EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. That said, the attack vector is remote: a malicious site can lure an authenticated user into sending requests that the application will accept if anti‑CSRF tokens are not also in use. The overall risk is modest, but the vulnerability still exposes the system to unintended state changes if proper mitigations are not applied.
