HCL Unica Centralized Offer Management ist anfällig für eine potentielle Server-Side Request Forgery (SSRF)

Successful exploitation of CVE-2025-31993 could allow an attacker to access sensitive internal resources that are otherwise protected. This could include accessing configuration files, internal APIs, or even other systems within the network. While the CVSS score is LOW, the potential impact depends heavily on the internal network architecture and the sensitivity of the resources accessible via SSRF. An attacker could potentially use this vulnerability as a stepping stone for further reconnaissance or lateral movement within the environment, depending on the permissions granted to the affected application.

Organizations utilizing HCL Unica Centralized Offer Management, particularly those with internal services accessible via the application, are at risk. Deployments with weak network segmentation or overly permissive access controls are especially vulnerable.

1. 2025-10-12Disclosure

   disclosure

1. Reserviert2025-04-01
2. Veröffentlicht2025-10-12
3. Geändert2025-10-14
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-31993 is to upgrade to version 25.1.1 or later, which includes the necessary fix for the input validation issue. If immediate upgrading is not possible, consider implementing strict input validation on the application's entry points to prevent malicious requests. Web Application Firewalls (WAFs) configured with appropriate rules to block suspicious outbound requests can also provide a temporary layer of protection. Regularly review and update network segmentation to limit the potential blast radius of a successful SSRF attack.