CVE-2025-55264

MEDIUM

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change

Title source: cna
STIX 2.1

Description

HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.

References (1)

Scores

CVSS v3 5.5
EPSS 0.0004
EPSS Percentile 10.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-613
Status published
Products (2)
HCL/Aftermarket DPC version 1.0.0
hcltech/aftermarket_cloud 1.0.0
Published Mar 26, 2026
Tracked Since Mar 26, 2026