HCL AION 2.0 contains a Content Security Policy vulnerability that allows for unauthorized inline script execution, posing a high risk to application integrity.

The application fails to properly restrict inline script execution within its Content Security Policy (CWE-1032). This flaw is exploitable by an unauthenticated remote attacker who can leverage user interaction to execute malicious scripts in the context of the victim's session.

The ability to execute unauthorized inline scripts can lead to cross-site scripting (XSS), which may result in session hijacking, the theft of sensitive user data, or the unauthorized modification of displayed content. With a CVSS score of 8.2, this vulnerability represents a high risk to the confidentiality and integrity of user interactions within the HCL AION platform.

Immediate Action: Consult the official HCL support advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444 to determine if a specific patch or configuration update is currently available for your deployment.

Proactive Monitoring: Review application access logs for suspicious patterns, such as unusual script injection attempts or unexpected redirection behavior directed at authenticated users.

Compensating Controls: Implement or strengthen existing Web Application Firewall (WAF) rules to filter malicious payloads and restrict script execution headers until a vendor-supplied patch is applied.

Public Exploit Available: Unknown

Given the high severity of this vulnerability, administrators should prioritize evaluating their current CSP implementation against the HCL security advisory. Although a specific patch status is currently unknown, applying available vendor guidance is essential to prevent potential exploitation of this cross-site scripting vector.