HCL iAutomate version 6.5.1 is vulnerable to insufficient session expiration, which allows session tokens to persist indefinitely and increases the risk of unauthorized access.

This vulnerability involves a flaw in session management (CWE-613) where tokens do not expire as expected. An authenticated user with low privileges can maintain an active session indefinitely, which creates a window of opportunity for an attacker to hijack an existing session if they gain access to the token.

The inability of the system to invalidate sessions poses a significant risk to data confidentiality and integrity. If a session is hijacked, an attacker could potentially access sensitive configuration data or perform unauthorized automation tasks within the iAutomate environment. With a CVSS score of 7.1, this is considered a High severity vulnerability that requires prompt attention to prevent unauthorized persistence in the application.

Immediate Action: Review the HCL security advisory (KB0122646) for specific configuration changes or available patches to enforce strict session timeouts.

Proactive Monitoring: Monitor user access logs for long-lived sessions or anomalous activity patterns that deviate from standard user behavior.

Compensating Controls: Implement network-level access controls to restrict access to the iAutomate interface to known, trusted IP addresses, reducing the likelihood of session token theft.

Public Exploit Available: No (exploit_available: false)

Given the High severity of this vulnerability and the potential for long-term unauthorized access, administrators must prioritize the review of the vendor provided documentation. Applying the recommended security updates is essential to ensuring that session management policies are correctly enforced and that active sessions are terminated appropriately.