CVE-2025-62341

LowCVSS 3.7/10Last modified Oct 19, 2026

Description

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
HCLSoftwareConnections7.0, 8.0

References

Timeline

Published
Aug 26, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-623426.4HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resuCVE-2025-623433.1HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain activCVE-2025-623452.7HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weaCVE-2025-623466.8A Cross-Site Request Forgery (CSRF) vulnerability was identified in HCL Glovius Cloud. An attacker can force a user's web browser to executeCVE-2025-623474.3HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security CVE-2025-623487.8Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module couCVE-2025-623496.2Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/securitCVE-2025-62356.1In ExtremeControl before 25.5.12, a cross-site scripting (XSS) vulnerability was discovered in a login interface of the affected applicationCVE-2025-623539.8A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary local files in and outCVE-2025-623549.8Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to executeCVE-2025-623567.5A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local files in and outside CVE-2025-623586.1WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configu