CVE-2024-42210
Published: 19 March 2026
Summary
CVE-2024-42210 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Hcltech Unica. Its CVSS base score is 7.6 (High).
Operationally, ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Filters information outputs to ensure untrusted stored data is rendered safely in HTTP responses, directly preventing stored XSS execution.
Validates information inputs from untrusted sources to block malicious scripts before they are accepted and stored by the application.
Restricts the types and characteristics of inputs accepted at system interfaces to exclude XSS payloads like script tags and other malicious code.
NVD Description
A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Marketing Operations v12.1.8 and lower. Stored cross-site scripting (also known as second-order or persistent XSS) arises when an application receives data from an untrusted source and includes that data within its…
more
later HTTP responses in an unsafe way.
Deeper analysisAI
CVE-2024-42210 is a stored cross-site scripting (XSS) vulnerability, also known as persistent or second-order XSS, affecting HCL Unica Marketing Operations versions 12.1.8 and lower. The issue arises when the application receives data from an untrusted source and includes that data within later HTTP responses in an unsafe manner. It carries a CVSS v3.1 base score of 7.6, with the vector AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, and is classified under CWE-79.
Exploitation requires network access (AV:N), high attack complexity (AC:H), high privileges (PR:H), and user interaction (UI:R). A successful attack can achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with a changed scope (S:C) that elevates the consequences beyond the vulnerable component.
Mitigation details are available in the HCL support knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123760 and the vulnerability research repository on GitHub at https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2024-42210/README.md. The CVE was published on 2026-03-19T08:16:18.700.
Details
- CWE(s)