CVE-2026-35147— HCL DFXServer 直接API访问导致认证漏洞
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| HCL Software | DFXServer | version 2.5 and below | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-35147の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access.
ソース: NVD (National Vulnerability Database)
脆弱性説明
HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when accessing specific API endpoints, allowing an unauthenticated attacker to interact with the APIs and perform unauthorized actions without valid credentials.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
通过用户控制密钥绕过授权机制
ソース: NVD (National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| HCL Software | DFXServer | version 2.5 and below | - |
II. CVE-2026-35147の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-35147のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-35147 厂商安全公告 (1)
Same Patch Batch · HCL Software · 2026-07-16 · 12 CVEs total
| CVE-2026-35149 | 8.2 HIGH | HCL DFXServer is affected by an Authentication Bypass vulnerability via server response ma |
| CVE-2026-35148 | 6.3 MEDIUM | HCL DFXServer is affected by a Missing Access Control vulnerability |
| CVE-2026-56454 | 5.9 MEDIUM | HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS |
| CVE-2026-56453 | 5.5 MEDIUM | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerabilit |
| CVE-2026-56456 | 5.3 MEDIUM | HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. |
| CVE-2026-56455 | 5.3 MEDIUM | HCL DFXAnalytics is affected by a Buffer Overflow vulnerability that can lead to a Denial |
| CVE-2026-35145 | 3.1 LOW | HCL DFXAnalytics is affected by a Missing HTTP Strict-Transport-Security Header vulnerabil |
| CVE-2026-35143 | 3.0 LOW | HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. |
| CVE-2026-35140 | 3.0 LOW | HCL DFXAnalytics is affected by a Missing Secure Attribute in Encrypted Session (SSL) Cook |
| CVE-2026-35142 | 2.6 LOW | HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. |
| CVE-2026-35141 | 2.6 LOW | HCL DFXAnalytics is affected by a Login Replay Attack vulnerability |
IV. 関連脆弱性
同じベンダー: HCL Software
- CVE-2026-56456
HCL DFXAnalytics is affected by an Internal File Path Disclo - CVE-2026-56455
HCL DFXAnalytics is affected by a Buffer Overflow vulnerabil - CVE-2026-56454
HCL DFXAnalytics is affected by a Deprecated Protocol vulner - CVE-2026-56453
HCL DFXAnalytics is affected by an Account Takeover via Resp - CVE-2026-35145
HCL DFXAnalytics is affected by a Missing HTTP Strict-Transp
同じ弱点: CWE-639
- CVE-2026-62233
grav-plugin-api < 1.0.6 Privilege Escalation via createApiKe - CVE-2026-43977
wger IDOR: Authenticated Users Can Read Others' Private Work - CVE-2026-11889
SALTO ProAccess Space Authorization Bypass Through User-Cont - CVE-2026-15945
Keycloak-services: keycloak-services: group hierarchy search - CVE-2026-54568
Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST
V. CVE-2026-35147へのコメント
まだコメントはありません