CVE-2025-62319

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-62319", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2025-10-10T09:04:19.898Z", "datePublished": "2026-03-16T15:30:52.165Z", "dateUpdated": "2026-03-17T12:53:56.374Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-16T15:30:52.165Z"}, "title": "Boolean-Based SQL Injection in Multiple Unica Components", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')", "type": "CWE"}]}], "affected": [{"vendor": "HCL", "product": "Unica", "versions": [{"status": "affected", "version": "Version 25.1.1 and below"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application."}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T15:58:04.965644Z", "id": "CVE-2025-62319", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T12:53:56.374Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62319", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T15:58:04.965644Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T15:58:49.650Z"}}], "cna": {"title": "Boolean-Based SQL Injection in Multiple Unica Components", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCL", "product": "Unica", "versions": [{"status": "affected", "version": "Version 25.1.1 and below"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.", "supportingMedia": [{"type": "text/html", "value": "Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-03-16T15:30:52.165Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62319", "state": "PUBLISHED", "dateUpdated": "2026-03-17T12:53:56.374Z", "dateReserved": "2025-10-10T09:04:19.898Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-03-16T15:30:52.165Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unica", "vendor": "HCL", "versions": [{"status": "affected", "version": "Version 25.1.1 and below"}]}], "source": "psirt@hcl.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F6C9EE-1E48-4706-AE2F-BDF3C91ED09B", "versionEndExcluding": "25.1.1.0.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:unica_audience_central:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEB22408-2278-4A8B-9C5E-D7F2995B3CED", "versionEndExcluding": "25.1.1.0.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application."}, {"lang": "es", "value": "La Inyecci\u00f3n SQL Basada en Booleanos es un tipo de inyecci\u00f3n SQL ciega donde un atacante manipula consultas SQL inyectando condiciones booleanas (VERDADERO o FALSO) en campos de entrada de la aplicaci\u00f3n. En lugar de devolver errores de la base de datos o datos visibles, la aplicaci\u00f3n responde de manera diferente dependiendo de si la condici\u00f3n inyectada se eval\u00faa como verdadera o falsa. Esto permite a un atacante inyectar SQL arbitrario en consultas de configuraci\u00f3n de backend ejecutadas dentro de la aplicaci\u00f3n."}], "id": "CVE-2025-62319", "lastModified": "2026-06-17T09:51:43.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "psirt@hcl.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62319", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T15:58:04.965644Z", "version": "2.0.3"}}]}, "published": "2026-03-16T16:16:13.167", "references": [{"source": "psirt@hcl.com", "tags": ["Not Applicable"], "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@hcl.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.1.1]"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "Unica", "source": "cna", "vendor": "HCL"}, "product": "unica", "vendor": "hcltech"}], "analysis": {"en": {"generated_at": "2026-03-17T11:52:18.858390+00:00", "value": {"mitigation_remediation": ["Apply the vendor\u2011supplied patch or upgrade to a release that fixes CVE-2025-62319.", "If a patch is not yet available, restrict external access to the affected Unica components and monitor application logs for suspicious queries.", "Consider deploying a web application firewall or other input\u2011validation controls to block malicious SQL injection attempts."], "summary": {"action": "Immediate Patch", "impact": "SQL injection allowing unauthorized data access and potential modification"}, "threat_synthesis": {"affected_systems": "The affected vendor is HCL Unica and the vulnerability spans multiple Unica components. No specific product version information is included in the CVE data, so administrators must consult the vendor reference for details on which releases are impacted.", "description_and_impact": "Boolean-based SQL injection is a blind technique that manipulates SQL queries by inserting Boolean conditions. When such a condition evaluates to true or false, the application behaves differently, enabling an attacker to execute arbitrary SQL against the backend without receiving error messages. This vulnerability can lead to unauthorized data disclosure and possible modification, compromising confidentiality and integrity of the system. The weakness is classified as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a very high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is via externally accessible application input fields. Exploitation requires the attacker to supply crafted input; if successful, the attacker can extract or alter data."}}}}, "created": "2026-03-17T09:52:38.651673+00:00", "updated": "2026-03-24T10:50:20.921104+00:00", "vendors": ["hcltech", "hcltech$PRODUCT$unica"]}