HCL AION Trusted Types in Scripts Not Enforced in CSP Vulnerability

A vulnerability has been identified in HCL AION version 2.0, where trusted types in scripts are not properly enforced in the Content Security Policy (CSP). This issue allows for unsafe script execution, increasing the risk of client-side vulnerabilities such as DOM-based cross-site scripting (XSS).

Impact

The vulnerability could lead to client-side issues, allowing for DOM-based cross-site scripting attacks, where an attacker could manipulate the Document Object Model in a way that could be harmful to the user or the application.

Remediation

Users can upgrade to HCL AION version 2.0.1, which addresses this vulnerability. For assistance with the upgrade process, contact the HCL AION Product support team.