{"id":"CVE-2025-59873","aliases":["EUVD-2025-207659","GHSA-hhvh-4rv2-p55m"],"status":"published","title":"Session Token Exposure via URL Query Parameters","description":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions\n\nThis issue affects ZIE for Web: v16.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00328,"percentile":0.26157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-598"],"published":"2026-02-23T10:56:52Z","modified":"2026-06-17T09:46:49Z","products":[{"vendor":"hcl software","product":"zie for web"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128902"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59873"},{"url":"https://github.com/advisories/GHSA-hhvh-4rv2-p55m"}],"sources":{"cve":[{"id":"CVE-2025-59873","title":"Session Token Exposure via URL Query Parameters","description":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions\n\nThis issue affects ZIE for Web: v16.","status":"published","published":"2026-02-23T10:56:52.305Z","modified":"2026-02-26T21:33:31.51Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:32:47.812946Z"}],"euvd":[{"id":"EUVD-2025-207659","description":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions\n\nThis issue affects ZIE for Web: v16.","status":"published","published":"2026-02-23T10:56:52Z","modified":"2026-02-26T21:33:31Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:14.049749Z"}],"ghsa":[{"id":"GHSA-hhvh-4rv2-p55m","title":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe...","description":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions\n\nThis issue affects ZIE for Web: v16.","status":"published","published":"2026-02-23T12:31:29Z","modified":"2026-02-27T00:31:45Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T15:06:24.001962Z"}],"nvd":[{"id":"CVE-2025-59873","description":"An information exposure vulnerability exists in\n\nVulnerability in HCL Software ZIE for Web.\n\nThe application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions\n\nThis issue affects ZIE for Web: v16.","status":"published","published":"2026-02-23T11:16:21.08Z","modified":"2026-06-17T09:46:49.557Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-598"],"updated_at":"2026-11-02T14:12:01.096037Z"}]}}