HCL AION Cookie SameSite Vulnerability Allowing Cross-Site Request Forgery
Vulnerability
A vulnerability exists in HCL AION version 2.0 related to cookies not properly implementing the SameSite attribute. This flaw can enable cookies to be sent with cross-site requests, thereby increasing the risk of cross-site request forgery (CSRF) attacks and similar security issues.
Impact
Exploitation of this vulnerability could lead to increased susceptibility to cross-site request forgery attacks, allowing an attacker to perform actions on behalf of a user without their consent.
Remediation
Users can upgrade to HCL AION version 2.1.0, which addresses this vulnerability. For assistance with the upgrade, contact the HCL AION Product support team.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.