EUVD-2025-209704CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.
AnalysisAI
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
Technical ContextAI
The vulnerability stems from CWE-209 (Information Exposure Through an Error Message), a common flaw where application error handling reveals sensitive technical details to attackers. In BigFix Service Management's reporting module, the parameter validation mechanism for consumer_company fails to sanitize exceptions before displaying them to users. The consumer_company parameter likely maps to an internal database query or business logic layer; when an invalid or out-of-range value is supplied, the application throws an unhandled exception that leaks debugging information, stack traces, database schema details, or other sensitive context. This is a classic information disclosure vulnerability with network-accessible attack surface (AV:N) requiring no authentication (PR:N) and no user interaction (UI:N).
RemediationAI
Apply the patch issued by HCL for BigFix Service Management as documented in vendor advisory KB0128144 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144). The patch adds proper input validation and exception handling to the consumer_company parameter in the reporting module, preventing error messages from leaking sensitive details. As an interim compensating control, restrict access to the BigFix SM reporting module via network firewall rules or WAF policies to trusted IP ranges only, and enable HTTP response body filtering to suppress stack traces and debugging information from reaching end users. Consider deploying a reverse proxy with error page rewriting to mask backend exceptions. These controls reduce information leakage but do not address the root cause and may impact legitimate users requiring debugging access.
Share
External POC / Exploit Code
Leaving vuln.today