EUVD-2025-209753
GHSA-g22r-4r4g-6mwr
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated network access required (PR:L, AV:N); impact is limited to low confidentiality disclosure of internal metadata with no integrity or availability consequences.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
AnalysisAI
Improper authorization in HCL BigFix WebUI exposes internal configuration data to authenticated users who lack Master Operator privileges. Authenticated low-privilege users can reach unprotected internal endpoints - which also lack adequate security response headers - to retrieve site names, software versions, and configuration variables that should be restricted to operators. No public exploit code exists and CISA has not listed this in KEV; EPSS at 0.04% (12th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure at time of analysis.
Technical ContextAI
HCL BigFix is an enterprise endpoint management platform; its WebUI component provides a browser-based interface for managing endpoints, software distributions, and policy deployments at scale. The CPE cpe:2.3:a:hclsoftware:bigfix_webui:*:*:*:*:*:*:*:* covers all released versions of the WebUI. The root cause is CWE-863 (Incorrect Authorization), meaning the application authenticates the user but fails to enforce role-based access controls on specific internal API or data endpoints - distinct from authentication bypass in the login sense. Compounding this, the affected endpoints reportedly lack adequate security response headers, suggesting a broader gap in endpoint hardening. The CVSS 4.0 vector (PR:L) confirms exploitation requires a valid session, so the flaw is an authorization enforcement failure post-authentication, not a pre-authentication vulnerability.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587 for patching guidance; the available data does not specify an exact fixed version, so the precise remediated release must be confirmed directly with HCL Software. Until a patch is applied, restrict access to the BigFix WebUI to the minimum set of user accounts necessary and enforce network-level controls (firewall rules, VPN segmentation) to limit which hosts can reach the WebUI service, reducing the pool of authenticated users who could exploit unprotected endpoints. Review and harden BigFix WebUI endpoint configurations to add required security headers (e.g., X-Frame-Options, Content-Security-Policy, X-Content-Type-Options) as a compensating control; note this addresses the missing-headers symptom but not the underlying authorization logic flaw. Audit BigFix WebUI user accounts and remove or demote any accounts that do not require active access.
More in Bigfix Webui
View allInsufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL querie
The BigFix WebUI uses weak cipher suites. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and befor
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external si
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixl
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. Rated medium sever
HCL BigFix WebUI exposes sensitive environmental information to authenticated users who lack proper authorization throug
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today