CVE-2025-52608: HCL iControl was affected by Missing Cookie Attributes vulnerability.
HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, including Secure and SameSite. And also path is set to root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure HCL iControl to set the Secure attribute on all session and authentication cookies so they are only sent over HTTPS.
HCL iControl cookie_secure_flag = enabled - Configuration
Configure HCL iControl to set the SameSite attribute on cookies (choose Strict if compatible, otherwise Lax) to mitigate CSRF risks.
HCL iControl cookie_samesite = set (e.g., Lax or Strict) - Configuration
Do not use Path=/ for cookies; set the cookie Path to the minimal application-specific path required to reduce cookie exposure.
HCL iControl cookie_path = restrict from / to the minimal required path
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52608?
The severity of CVE-2025-52608 is classified as low with a score of 3.1.
What vulnerability is associated with CVE-2025-52608?
CVE-2025-52608 is linked to a Missing Cookie Attributes vulnerability affecting HCL iControl.
How do I fix CVE-2025-52608?
To mitigate CVE-2025-52608, ensure that the application sets the missing cookie attributes, including Secure and SameSite.
What could happen if CVE-2025-52608 is exploited?
Exploitation of CVE-2025-52608 could lead to session hijacking due to unsecured cookies, though the risk is considered low.
Which software is affected by CVE-2025-52608?
CVE-2025-52608 affects the HCL iControl application.