Skip to main content

Bigfix Webui CVE-2025-15633

| EUVDEUVD-2025-209753 MEDIUM
Incorrect Authorization (CWE-863)
2026-05-09 HCL GHSA-g22r-4r4g-6mwr
Authentication Bypass Bigfix Webui
5.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
May 09, 2026 - 04:58 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Analysis

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

More in Bigfix Webui

View all
CVE-2023-28019 HIGH
8.8 Jul 18

Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL querie
CVE-2023-28021 HIGH
7.5 Jul 18

The BigFix WebUI uses weak cipher suites. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
CVE-2023-28023 MEDIUM
6.5 Jul 18

A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and befor
CVE-2023-28020 MEDIUM
6.1 Jul 18

URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external si
CVE-2022-38655 MEDIUM
5.8 Dec 21

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixl
CVE-2020-4104 MEDIUM
5.4 Jul 17

HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. Rated medium sever
CVE-2025-15634 MEDIUM
5.3 May 09

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to vie

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8
CVE-2024-38856 CRITICAL POC
9.8
CVE-2023-22518 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2025-15633 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy