CVE-2025-31991 HCL DevOps Velocity is susceptible to brute-force attacks
CriticalCVSS 9.8
EPSS 0.24%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HCLSoftware Velocity | = <.5.1.7 | No fix listed |
| hcltech devops velocity | < 5.1.7 | 5.1.7 |
References
- support.hcl-software.com vendor-advisory