HCL DevOps Deploy vulnerabilities

A vulnerability in HCL DevOps Deploy / HCL Launch allows authenticated users to access sensitive configurations and secrets in API responses, which could be leveraged for further attacks against the system.

The vulnerability in HCL DevOps Deploy stems from improper CORS configuration that does not restrict domains to trusted ones. This allows an attacker to perform privileged actions and retrieve sensitive information.

In HCL DevOps Deploy versions 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing authenticated LLM Queries.