HCL Glovius Cloud 存在跨站请求伪造 (CSRF) 漏洞

The CSRF vulnerability in Glovius Cloud allows an attacker to craft malicious requests that appear to originate from a legitimate, authenticated user. Successful exploitation could lead to unauthorized modifications of user settings, data manipulation, or other actions depending on the functionality exposed by the vulnerable endpoint. While the description specifies a single endpoint, the potential impact depends on the sensitivity of that endpoint's functionality. The attacker needs to trick the user into clicking a malicious link or visiting a crafted webpage.

Organizations utilizing HCL Glovius Cloud, particularly those with users who frequently access the platform through web browsers, are at risk. Environments with shared user accounts or those lacking robust user awareness training are particularly vulnerable.

1. 2025-11-20Disclosure

   disclosure

1. 已保留2025-10-10
2. 发布日期2025-11-20
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-62346 is to upgrade to a patched version of HCL Glovius Cloud. Refer to HCL's security advisory for the specific fixed version. As a temporary workaround, implement strict input validation and output encoding on the vulnerable endpoint to reduce the attack surface. Consider implementing CSRF tokens or other anti-CSRF mechanisms on the affected endpoint if upgrading immediately is not possible. Review user access controls to limit the potential impact of a successful attack.