HCL Unica Platform is vulnerable to XML External Entity (XXE) injection

HCL Unica Platform has a flaw in how it processes XML files that allows attackers to inject malicious code by inserting harmful references into the XML. This can lead to data theft or system compromise.

The vulnerability exists in XML parsing logic that does not adequately validate or disable external entity resolution. An attacker can craft malicious XML input containing external entity declarations to access sensitive files, perform SSRF attacks, or cause denial of service. Pre-condition requires the ability to submit XML content to the application.