EUVD-2025-209688
GHSA-4w64-m6x6-926r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (HCL) · only source for this CVE.
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .
AnalysisAI
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
Technical ContextAI
The vulnerability stems from CWE-1230 (Insufficient Logging of Exfiltration of Sensitive Information), which in this context manifests as the application's failure to sanitize or remove Exchangeable Image File Format (EXIF) data during image upload processing. EXIF metadata can contain GPS coordinates, camera settings, timestamps, and device identifiers embedded by cameras and smartphones. BigFix Service Management, an IT service management solution, processes user-uploaded images without stripping this metadata, creating an unintended information disclosure channel. The affected component operates across all versions of the affected CPE range (cpe:2.3:a:hcl_software:bigfix_service_management_(sm):*:*:*:*:*:*:*:*), indicating the flaw exists in the core image handling functionality.
RemediationAI
HCL has released guidance via support article KB0128144 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144). Organizations should immediately consult this advisory for the patched version and upgrade timeline. As an interim compensating control, restrict image upload functionality to administrative users only and audit uploaded images for sensitive location data before they are shared or archived. Alternatively, educate users on the risks of uploading images from personal devices without removing EXIF data first; users can strip EXIF data locally using third-party tools (e.g., ExifTool, online stripping services) before uploading to BigFix SM. Implement access controls on image archives to limit exposure if metadata is already embedded. These workarounds do not remediate the underlying flaw but reduce the likelihood of accidental exposure until a patch is deployed.
More in Bigfix Service Management Sm
View allHCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
HTTP request smuggling in HCL BigFix Service Management (SM) 23 allows unauthenticated remote attackers to bypass front-
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a b
HCL BigFix Service Management (SM) version 23 ships with - or can be deployed in - a state where the host root filesyste
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type s
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessib
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-s
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today