CVE-2025-31952 HIGH

CVE-2025-31952: HCL iAutomate is affected by an insufficient session expiration

Vendor Hcl Software

Product iAutomate

Weakness CWE-613 · Insufficient session expiration

Published July 24, 2025

Last update July 25, 2025

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

What the vulnerability does

01Description

HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.

Key dates

02Disclosure timeline

July 24, 2025 CVE published

July 25, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-31952 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/613.html

Related vulnerabilities

CVE-2025-31952: HCL iAutomate is affected by an insufficient session expiration

01Description

02Disclosure timeline

03References

04Related CVE