HCL BigFix WebUI CVE-2025-15634

Exploitation requires a valid authenticated session in HCL BigFix WebUI with an account that holds at least low-level permissions (PR:L per CVSS 4.0 vector). The attacker must know or enumerate the URL of the restricted page, as no redirection or link is provided by the application to unauthorized users. No special server configuration or non-default feature needs to be enabled - the flaw is present in the base WebUI across all versions. Exploitation is limited to users who can authenticate to the WebUI; unauthenticated external attackers cannot exploit this vulnerability. The impact is also bounded to read-only confidentiality of environmental information - no write access, code execution, or availability impact is possible through this vector.

Real-world risk is low-to-moderate despite the medium CVSS 5.3 score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L) confirms the attack is network-reachable with low complexity but critically requires an authenticated session (PR:L), which substantially narrows the attack surface to insiders or compromised credential scenarios. EPSS at 0.03% (9th percentile) reinforces that exploitation is unlikely at scale. SSVC independently rates exploitation as none and the attack as not automatable, with only partial technical impact. The impact is strictly confidentiality-limited - no integrity or availability impact - and scoped to environmental information rather than credentials, code, or customer data. This is a genuine access control gap that should be patched but does not represent an emergency priority compared to unauthenticated or high-impact flaws. SSVC and EPSS signals are consistent with each other, with no conflicting data.

An authenticated BigFix WebUI user with limited permissions - such as an IT helpdesk operator - directly navigates to a known or enumerated internal URL corresponding to an administrative or diagnostic page they are not permitted to access. The application serves the page without performing an authorization check on the session, exposing environmental configuration details such as server settings, infrastructure topology, or deployment parameters. No exploit code is required beyond a standard browser and knowledge of the target URL path.