Threat Intelligence Database

HCL Hive version 1.0 is affected by the use of unmaintained third-party components that contain publicly documented security flaws. This vulnerability could allow an attacker to gain unauthorized access to the system. The issue is classified under CWE-1104, indicating the use of vulnerable third-party components. The vulnerability has a high severity with a CVSS score of 7.5. HCL Hive is a cloud service, and the vendor manages remediation for this service. No known exploits are reported in the wild at this time.

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service.

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitive information (e.g., credentials, PII) was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface.