HCL DevOps Deploy implements Cross-Origin Resource Sharing (CORS) in a permissive fashion, allowing any domain to set the Access‑Control‑Allow‑Origin header. This configuration flaw, identified as CWE‑942, can give an attacker the ability to send cross‑origin HTTP requests from an arbitrary website to a reachable DevOps Deploy instance. If the server processes these requests, it may allow the attacker to read confidential data or perform operations that should require authentication, because the CORS header alone does not provide any enforcement of access control.

The vulnerability affects HCL Software’s HCL DevOps Deploy product. Any instance using the default CORS configuration may be vulnerable unless a patch or configuration change has been applied. Version information is not specified in the CVE data.

The vulnerability has a CVSS score of 5.4, placing it in the moderate severity range. The EPSS score is less than 1%, indicating a very low likelihood of widespread exploitation at present, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to host a malicious page that issues cross‑origin requests to a reachable DevOps Deploy instance that accepts the permissive CORS policy. Successful exploitation would allow the attacker to read sensitive data or initiate privileged actions, depending on the server’s underlying authentication and authorization controls.