CVE-2025-0272: hcl software hcl devops deploy / hcl launch
CVSS: 7.6v3.1HighAnalyzed
Published 03-04-2025Last modified 04-04-2025
Vulnerability summary
CVE-2025-0272 is a high (CVSS 7.6) vulnerability in hcl software hcl devops deploy / hcl launch. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16% of scored vulnerabilities.
CVSS score
7.6/10
010
High · v3.1 (NVD)EPSS score
0.26%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 03-04-2025PublishedVulnerability first disclosed.
- 04-04-2025Last modifiedVulnerability information updated.
Description
HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
CVSS metrics
2 scores · 2 sources · 1 versionHigh 7.6Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:NSources2 sources · 5.4–7.6
- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.01 pp
From 0.25% on 19-09-2026
19-09-202619-10-2026
EPSS score0.26%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Hcltechsw2 products
- hcl_devops_deploy≥ 8.0.0.0, < 8.0.1.5 | ≥ 8.1.0, < 8.1.0.1
- hcl_launch≥ 7.0.0.0, ≤ 7.0.5.26 | ≥ 7.1.0.0, < 7.1.2.22 | ≥ 7.2.0.0, < 7.2.3.15 | ≥ 7.3.0.0, ≤ 7.3.2.9
Hcl software1 product
- hcl devops deploy / hcl launch7.0 - 7.0.5.26; 7.1 - 7.1.2.21; 7.2 - 7.2.3.14; 7.3 - 7.3.2.9; 8.0 - 8.0.1.4; 8.1 - 8.1.0.0
2 vendors · 3 products