CVE-2025-31997
MediumCVSS 4.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
Risk Assessment
An attacker may access data or files they are not authorized to, potentially resulting in information disclosure or unauthorized changes. This may compromise the confidentiality and integrity of organizational data.
Recommendation
Apply available security updates from HCL. Additionally, review access control and authorization mechanisms in the application.
Other vulnerabilities in HCL Unica Centralized Offer Management
See all- CVE-2025-31998Low
HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit this information to launch targeted attacks, such as remote code execution or denial of service.
- CVE-2025-31993Low
HCL Unica Centralized Offer Management is vulnerable to Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.
Original NVD description (English source)
HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS