CVE-2026-56453
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter HTTP responses to bypass authentication and authorization controls, gaining unauthorized access to user accounts.
Risk Assessment
The risk involves unauthorized account access, potentially leading to data theft, privilege escalation, and system confidentiality breaches.
Recommendation
Immediately update HCL DFXAnalytics to the latest patched version and implement HTTP response integrity mechanisms such as signing or encryption.
Other vulnerabilities in HCL DFXAnalytics
See all- CVE-2026-56456Medium
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application leaks sensitive information about its internal file structure through unhandled errors, logs, or debug output, allowing a remote attacker to map the server environment.
- CVE-2026-56455Medium
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive.
- CVE-2026-56454Medium
HCL DFXAnalytics uses deprecated TLS 1.0 and TLS 1.1 protocols, which have numerous cryptographic flaws. This allows interception and decryption of transmitted data.
- CVE-2026-35145Low
HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.
- CVE-2026-35143Low
The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
- CVE-2026-35142Low
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
- CVE-2026-35141Low
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. A remote attacker can intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access.
- CVE-2026-35140Low
HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
Original NVD description (English source)
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.