CVE-2025-62330
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
HCL DevOps Deploy is susceptible to cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. An attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
Risk Assessment
Interception of credentials and session data could lead to unauthorized access to the deployment system, potentially compromising the confidentiality and integrity of DevOps processes.
Recommendation
Configure the HCL DevOps Deploy server to enforce HTTPS redirect and disable unencrypted HTTP access.
Other vulnerabilities in HCL DevOps Deploy
See all- CVE-2026-56460Medium
A vulnerability in HCL DevOps Deploy / HCL Launch allows authenticated users to access sensitive configurations and secrets in API responses, which could be leveraged for further attacks against the system.
- CVE-2026-56458Medium
The vulnerability in HCL DevOps Deploy stems from improper CORS configuration that does not restrict domains to trusted ones. This allows an attacker to perform privileged actions and retrieve sensitive information.
- CVE-2025-62327Medium
In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.
Original NVD description (English source)
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS as intended. As a result, an attacker with network access could intercept or modify user credentials and session-related data via passive monitoring or man-in-the-middle attacks.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS