The vulnerability in HCL Connections allows an attacker to inject and execute arbitrary script code within the web browser of a user who interacts with the affected component. This form of cross‑site scripting can lead to theft of cookie‑based authentication credentials and compromise the attacker’s ability to perform additional attacks against the victim’s account.

HCL Software’s HCL Connections product is affected. The CVE description does not list specific versions, so any installation of HCL Connections that includes the vulnerable component should be considered at risk and reviewed for the relevant fix from the vendor.

The CVSS score of 5.4 indicates a moderate severity level, and no EPSS score is published, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the nature of cross‑site scripting, the likely attack vector is a remote attacker submitting malicious input through a web interface that is inadequately sanitized, causing the script to run in the victim’s browser. An attacker executing the injected script can steal session cookies and hijack the victim’s authenticated session, potentially leading to further compromise.