CVE-2025-31970

Description

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS)

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS — Exploit Prediction

0.0003

Probability of exploitation

0.10%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-358 CWE-358

CWE-79 Cross-site Scripting (XSS)

Affected Products

Vendor	Product	Versions
hcltech	dfxanalytics	< 4.1

References

Advisories & Patches

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130569

Frequently Asked Questions

What is CVE-2025-31970? +

HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-src and base-uri, which could allow an attacker to exploit injection vectors such as Cross-Site Scripting (XSS) It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-31970? +

CVE-2025-31970 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0003, placing it in the 0th percentile for exploitation probability.

What products are affected by CVE-2025-31970? +

CVE-2025-31970 affects products from hcltech, specifically: dfxanalytics. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-31970? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-40597

Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.28.1 and below, given any pre-existing XSS / …

CVE-2024-12056

The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could …

CVE-2025-62583 9.8

Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.

CVE-2025-69234 9.1

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

CVE-2024-2174 8.8

Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via …

CVE-2024-6101 8.8

Inappropriate implementation in V8 in Google Chrome prior to 126.0.6478.114 allowed a remote attacker to perform out of bounds memory …