CVE-2025-62329

Published: Dec 16, 2025Modified: Jun 17, 2026

5.6

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.2 / Impact: 3.4

Source: NVD

Description

HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions.

Affected (3)

Products: Hcltechsw: Hcl Devops Deploy, Hcl Launch

2 products

Hcl Devops Deploy

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Hcltechsw Hcl Devops Deploy	From 8.0.0.0 to 8.0.1.11
Hcltechsw Hcl Devops Deploy	From 8.1.0 to 8.1.2.4
Hcltechsw Hcl Launch	From 7.3.0.0 to 7.3.2.16

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332

Source: psirt@hcl.com

Vendor Advisory

Timeline

No history available yet.