CVE-2025-52624 — MEDIUM (5.4)

Vulnerability Description

A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Hcltech	Aion	2.0.0

Related Weaknesses (CWE)

CWE-1032 CWE-79

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444Vendor Advisory

FAQ

What is CVE-2025-52624?

CVE-2025-52624 is a vulnerability with a CVSS score of 5.4 (MEDIUM). A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of ...

How severe is CVE-2025-52624?

CVE-2025-52624 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-52624?

Check the references section above for vendor advisories and patch information. Affected products include: Hcltech Aion.