HCL Digital Experience and HCL Digital Experience Compose could be vulnerable to Host header injection (CWE-601). In plain terms, an attacker can send a crafted HTTP request with a manipulated Host header, causing the application to behave in unexpected ways. The issue affects HCL Digital Experience and HCL Digital Experience Compose, but the provided reference content does not include specific affected version ranges.
From the NVD description, the root issue is that the application does not properly handle or validate the incoming Host header. The attack vector is network-based (AV:N) and requires no privileges (PR:N). The user interaction requirement (UI:R) suggests the attacker must cause a victim to make or load a crafted request (e.g., via a link or browser navigation), after which the application may use the attacker-controlled Host value in downstream logic (the exact code paths or functions are not present in the provided reference content). The exploitation mechanism is therefore: send an HTTP request with a malicious Host header; the application processes it and may generate incorrect responses, redirects, or other behavior influenced by the header, leading to unexpected outcomes.
Impact is rated medium with CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). This indicates the attacker may achieve limited confidentiality and integrity impact (C:L, I:L) with no availability impact (A:N). The scope is changed (S:C), meaning the vulnerability could affect components beyond the immediate vulnerable application boundary. In practical terms, Host header injection commonly enables attacks such as cache poisoning, incorrect URL generation, or redirect/response manipulation—however, the provided materials do not specify which concrete outcomes occur in HCL Digital Experience/Compose.
Mitigation: The provided reference content (KB0130849) is not included in a usable form here (it only shows “Loading…”), so patched version numbers, specific configuration changes, or official workarounds are not available from the supplied text. As a general mitigation for Host header injection, ensure the application validates the Host header against an allowlist of expected domains/virtual hosts and does not trust it for security-sensitive decisions (e.g., URL generation, redirects, or routing). For detection guidance, monitor for requests with unexpected Host values and alert on anomalous hostnames or mismatches between the requested host and the expected deployment hostnames. To complete this section with exact patched versions/workarounds, the full contents of KB0130849 (including affected/fixed versions) would be required.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-601