CVE Catalog
CVE-2025-52608
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk0.10%
1th percentile - higher than 1% of all known CVEs
Summary
HCL iControl is missing critical cookie attributes like Secure and SameSite, and the path is set to root. This can lead to session hijacking or CSRF attacks.
Risk Assessment
Risk of session hijacking or unauthorized actions within the session context, potentially compromising application security.
Recommendation
Configure the application to set Secure and SameSite attributes on cookies. Update HCL iControl to a patched version.
Original NVD description (English source)
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.