HCL AION Missing or Insecure HTTP Strict-Transport-Security Header Vulnerability

A vulnerability exists in HCL AION version 2.0 due to a missing or insecure HTTP Strict-Transport-Security (HSTS) header. This absence can lead to insecure connections, making the application susceptible to man-in-the-middle and protocol downgrade attacks.

Impact

The lack of a proper HSTS header can allow insecure connections, potentially exposing the application to man-in-the-middle and protocol downgrade attacks.

Remediation

Users can upgrade to HCL AION version 2.1.0, which addresses this vulnerability. For assistance with the upgrade process, contact the HCL AION Product support team.