CVE-2025-31993 is a low severity (CVSS 3.5) server side request forgery in HCL Unica Centralized Offer Management. Crafted input can make the server send requests it should not. The vendor bulletin KB0124422 holds the fixed version, so read it and apply the update.
What's affected
The NVD record names HCL Unica Centralized Offer Management and gives no version range in its text. The weakness class is CWE-918 (server side request forgery). The record says improper input validation lets an attacker submit crafted input to an application running on a server.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:L. It needs high privileges and some user interaction, which is why the score is only 3.5. Confidentiality and availability are rated low, integrity none.
I could not read the version table. The HCL bulletin is a script rendered page that did not load for a plain fetch, so the affected and fixed versions need to be taken from it directly. The bulletin is also shared with CVE-2025-31998, another low rated issue in the same product.
How to check if you're exposed
Unica is installed software, so the check is an inventory and version check.
- Confirm whether Centralized Offer Management is deployed in your Unica installation, and which release it is.
- Open bulletin KB0124422 on the HCL support site and compare your release with the affected and fixed versions it lists.
- Check who holds high privilege accounts in the application, since the vector requires one.
- Review outbound network rules from the application server. SSRF is only as useful as the places the server is allowed to reach.
The Gold entry linked above tracks the same record if you want to follow changes to it.
What to do now
- Read the HCL bulletin and note the fixed release for your version line.
- Schedule the vendor update. A low score does not mean no action, but it does let you fit it into a normal maintenance window.
- Restrict egress from the application server to the systems it actually needs, and block access to cloud metadata addresses if it runs in a cloud account.
- Review the list of users with high privileges and remove accounts that are no longer needed.
- Log outbound requests from the application so unusual destinations stand out.
The free in-browser dependency scan takes a manifest or lockfile and lists known CVEs for the packages in it, and the Gold directory lets you look up a CVE by id.
Why it matters
SSRF turns a server into a proxy. The application is trusted by internal systems, so a request that it sends can reach places an outside user cannot. Even where the direct impact is small, as the low score here suggests, SSRF is often the first step in a longer chain.
The usual defences are allow lists for destinations, refusing internal address ranges, and egress controls on the host. Input validation alone tends to miss one of the many ways to write an address.
Quick check
What is the fixed version?
The advisory should be checked. The NVD record does not state it, and the HCL bulletin KB0124422 is the source.
Is it exploited in the wild?
No. It is not on the CISA KEV list and nothing reviewed reports attacks.
Sources
- Gold entry for CVE-2025-31993
- HCL security bulletin KB0124422, listed in the NVD record. The page needs a browser to render, so read the fixed version there.
Last reviewed: 19 October 2026.
