CVE-2026-56456
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application leaks sensitive information about its internal file structure through unhandled errors, logs, or debug output, allowing a remote attacker to map the server environment.
Risk Assessment
The risk is that an attacker can gather detailed server infrastructure information, facilitating more advanced attacks such as privilege escalation or code injection.
Recommendation
Update HCL DFXAnalytics to the latest patched version and configure error handling and logging to prevent disclosure of internal file paths.
Other vulnerabilities in HCL DFXAnalytics
See all- CVE-2026-56455Medium
HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial of Service (DoS). The application fails to properly validate input sizes, allowing an attacker to pass an excessive amount of information into a memory container, which can cause the system to crash or become unresponsive.
- CVE-2026-56454Medium
HCL DFXAnalytics uses deprecated TLS 1.0 and TLS 1.1 protocols, which have numerous cryptographic flaws. This allows interception and decryption of transmitted data.
- CVE-2026-56453Medium
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter HTTP responses to bypass authentication and authorization controls, gaining unauthorized access to user accounts.
- CVE-2026-35145Low
HCL DFXAnalytics is missing the HTTP Strict-Transport-Security (HSTS) header, allowing a remote attacker to downgrade the connection to unencrypted HTTP and perform man-in-the-middle (MitM) attacks.
- CVE-2026-35143Low
The vulnerability in HCL DFXAnalytics is due to the missing SameSite attribute on session cookies generated during authentication. This could allow a remote attacker to perform Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.
- CVE-2026-35142Low
HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.
- CVE-2026-35141Low
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. A remote attacker can intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access.
- CVE-2026-35140Low
HCL DFXAnalytics fails to set the "secure" attribute on session cookies generated during authentication. This vulnerability allows a remote attacker to intercept network traffic and capture sensitive cookies, session tokens, or credentials sent in cleartext over unencrypted channels.
Original NVD description (English source)
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a remote attacker to map the underlying server environment and identify targets for further exploitation.