HCL DFXAnalytics Login Replay Attack Vulnerability

A login replay attack vulnerability has been identified in HCL DFXAnalytics versions 3.0 and below. This vulnerability allows remote attackers to intercept, delay, or fraudulently retransmit valid authentication data, potentially leading to unauthorized access. The issue arises because the application does not include timestamps with authentication messages, allowing outdated messages to be accepted as valid.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts by allowing attackers to replay authentication data.

Remediation

Users can upgrade to HCL DFXAnalytics version 4.1, where this vulnerability has been successfully mitigated.