HCL AION Content Security Policy Bypass Vulnerability Allowing Unauthorized Script Execution

A vulnerability exists in HCL AION version 2.0, allowing a bypass of the script allowlist configuration. An improperly set Content-Security-Policy header could enable unauthorized scripts to run, heightening the risk of cross-site scripting and other injection-related attacks.

Impact

Exploitation of this vulnerability could lead to cross-site scripting or other injection-based attacks, allowing for the execution of malicious scripts in the user's browser.

Remediation

This vulnerability has been fixed in HCL AION version 2.0.1. Customers using earlier versions should upgrade to 2.0.1. For assistance with the upgrade process, contact the HCL AION Product support team.