EUVD-2025-209754
GHSA-957m-p4pq-mxmf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authenticated session (PR:L); impact is limited confidentiality only with no scope change.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
AnalysisAI
HCL BigFix WebUI exposes sensitive environmental information to authenticated users who lack proper authorization through direct URL access to restricted pages. An authenticated low-privilege user can bypass access controls by directly navigating to unauthorized endpoints, resulting in unintended disclosure of environmental configuration data. No public exploit or active exploitation has been identified; EPSS sits at 0.03% (9th percentile) and SSVC rates exploitation as none with only partial technical impact.
Technical ContextAI
HCL BigFix WebUI is the browser-based management console for the HCL BigFix endpoint management platform, widely deployed in enterprise environments for patch management and compliance. The vulnerability is rooted in CWE-862 (Missing Authorization), a broken access control class where the application authenticates the user but fails to verify whether that user holds the required permissions before serving a restricted resource. In this case, direct URL navigation to an unauthorized page bypasses the authorization gate - a classic forced-browsing pattern. The affected product is identified by CPE cpe:2.3:a:hclsoftware:bigfix_webui:*:*:*:*:*:*:*:*, indicating all versions of the WebUI component are affected.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587 (KB0130587) for the official patch or upgrade instructions - no specific fixed version number is confirmed in the available intelligence data, so the advisory should be treated as the authoritative source. As a compensating control pending patch application, restrict network access to the BigFix WebUI administrative interface to trusted internal subnets or VPN-only segments, limiting the pool of users who can reach the unauthorized endpoint. Additionally, review and enforce role-based access controls within BigFix to ensure the principle of least privilege is applied to all WebUI user accounts, reducing the impact surface if the authorization bypass is exercised.
More in Bigfix Webui
View allInsufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL querie
The BigFix WebUI uses weak cipher suites. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and befor
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external si
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixl
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. Rated medium sever
Improper authorization in HCL BigFix WebUI exposes internal configuration data to authenticated users who lack Master Op
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today