CVE-2026-35143 PUBLISHED

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability.

Assigner: HCL
Reserved: 01.04.2026 Published: 16.07.2026 Updated: 16.07.2026

HCL DFXAnalytics is affected by a Missing SameSite Attribute vulnerability. The application fails to set the "SameSite" attribute on session cookies generated during authentication, which could allow a remote attacker to execute Cross-Site Request Forgery (CSRF) attacks if additional mitigations, such as Anti-CSRF tokens, are not implemented.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS Score: 3

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	HCL Software
Product	DFXAnalytics
Versions	Default: unaffected Version version 3.0 and below is affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787

Problem Types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE