CVE-2025-31952

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
HCL Software	iAutomate	6.5.1

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646Vendor Advisory

Timeline

Published: Jul 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319536.5HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unaut CVE-2025-319544.3HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and i CVE-2025-319556.5HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information wit CVE-2025-319575.7HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized chang CVE-2025-319588.2HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HT CVE-2025-319593.5HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and pr CVE-2025-31965.5A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2 CVE-2025-319605.3HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was CVE-2025-319614.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-319624.3Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gai CVE-2025-319633.3Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local atta CVE-2025-319644.9Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact s