HCL DevOps Deploy Cleartext Transmission of Sensitive Information Vulnerability

A vulnerability exists in HCL DevOps Deploy versions 8.1 prior to 8.1.2.3, allowing for cleartext transmission of sensitive information. The HTTP port remains accessible without proper redirection to HTTPS, enabling attackers with network access to intercept or modify user credentials and session data. This vulnerability could be exploited through passive monitoring or man-in-the-middle attacks.

Impact

Exploitation of this vulnerability could lead to interception or modification of user credentials and session-related data.

Remediation

Users are advised to upgrade to version 8.1.2.4, 8.2.0.0 or later. These versions are available through the My HCLSoftware Portal.