CVE-2025-62320 HTML Injection Leading to Data Exfiltration to External Server vulnerability affects HCL Unica Platform
MediumCVSS 6.1
EPSS 0.19%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL Sametime | = version 25.1.1 and below. | No fix listed |
| hcltech unica | < 12.1.11 | 12.1.11 |
| hcltech unica | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica audience central | < 12.1.11 | 12.1.11 |
| hcltech unica audience central | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica campaign | < 12.1.11 | 12.1.11 |
| hcltech unica campaign | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica centralised offer management | < 12.1.11 | 12.1.11 |
| hcltech unica centralised offer management | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica contact central | < 12.1.11 | 12.1.11 |
| hcltech unica contact central | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica interact | < 12.1.11 | 12.1.11 |
| hcltech unica interact | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica journey | < 12.1.11 | 12.1.11 |
| hcltech unica journey | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica plan | < 12.1.11 | 12.1.11 |
| hcltech unica plan | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
| hcltech unica segment central | < 12.1.11 | 12.1.11 |
| hcltech unica segment central | >= 25.1.0, < 25.1.1.0.1 | 25.1.1.0.1 |
References
- support.hcl-software.com patch vendor-advisory