What is CVE-2025-31997?

CVE-2025-31997 is a medium-severity vulnerability in Hcl Software Unica Centralized Offer Management, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.2/10. Published 2025-10-12.

How severe is CVE-2025-31997?

Medium severity. CVSS v3 base score is 4.2 out of 10.

Auth bypass in Hcl Software Unica Centralized Offer Management

CVE-2025-31997

HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.

Vulnerability class: IDOR (Insecure Direct Object Reference)

EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N.

Affected products

Hcl Software Unica Centralized Offer Management — versions <=25.1
Hcltech Unica_centralized_offer_management

Weakness classification (CWE)

CWE-639 — Authorization Bypass Through User-Controlled Key

References

psirt@hcl.com (Vendor Advisory)

Frequently asked questions

What is CVE-2025-31997?: CVE-2025-31997 is a medium-severity vulnerability in Hcl Software Unica Centralized Offer Management, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 4.2/10. Published 2025-10-12.
How severe is CVE-2025-31997?: Medium severity. CVSS v3 base score is 4.2 out of 10.