HCL Traveler is affected by generation of error messages containing sensitive information

published 2025-04-03 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-9725

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, sensitive tokens, credentials, error codes, or stack traces. Attackers could exploit this information to gain insights into the system's architecture and potentially launch targeted attacks.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago (2025-04-07)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

HCL Software HCL Traveler

Classification

Weakness

CWE-209 Generation of Error Message Containing Sensitive Information

References

support.hcl-software.com /csm?id=kb_article&sysparm_article=KB0120336
vendor-advisory

Sources

CVE List CVE-2025-0279
NVD CVE-2025-0279

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary