{"id":"CVE-2025-31969","aliases":["EUVD-2025-33890","GHSA-cpqg-x3j4-hhv6"],"status":"published","title":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)","description":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00164,"percentile":0.0566,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-358"],"published":"2025-10-12T07:37:24Z","modified":"2026-10-08T13:10:00Z","products":[{"vendor":"hcl software","product":"unica platform"},{"vendor":"hcltech","product":"unica"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0124417","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31969"},{"url":"https://github.com/advisories/GHSA-cpqg-x3j4-hhv6"}],"sources":{"cve":[{"id":"CVE-2025-31969","title":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP)","description":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.","status":"published","published":"2025-10-12T07:37:24.785Z","modified":"2025-10-14T14:06:18.566Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-33890","description":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.","status":"published","published":"2025-10-12T07:37:24Z","modified":"2025-10-14T14:06:18Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T20:31:33.532032Z"}],"ghsa":[{"id":"GHSA-cpqg-x3j4-hhv6","title":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result...","description":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.","status":"published","published":"2025-10-12T09:30:54Z","modified":"2025-10-12T09:31:00Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","level":"medium"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T15:03:56.92957Z"}],"nvd":[{"id":"CVE-2025-31969","description":"HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP).  These can result in malicious resources getting loaded and browsers may come across certain types of attacks, such as cross-site scripting and clickjacking.","status":"published","published":"2025-10-12T08:15:40.21Z","modified":"2026-10-08T13:10:00.2Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:11:36.851295Z"}]}}