What is the CVSS score of CVE-2025-31960?

CVE-2025-31960 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

HCL BigFix Service Management CVE-2025-31960

EUVD-2025-209704 MEDIUM

Error Message Information Leak (CWE-209)

2026-05-06 HCL

Information Disclosure Bigfix Service Management Sm

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 19:00 vuln.today

DescriptionCVE.org

HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request causes the application to trigger an unhandled exception.

AnalysisAI

HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.

Technical ContextAI

The vulnerability stems from CWE-209 (Information Exposure Through an Error Message), a common flaw where application error handling reveals sensitive technical details to attackers. In BigFix Service Management's reporting module, the parameter validation mechanism for consumer_company fails to sanitize exceptions before displaying them to users. The consumer_company parameter likely maps to an internal database query or business logic layer; when an invalid or out-of-range value is supplied, the application throws an unhandled exception that leaks debugging information, stack traces, database schema details, or other sensitive context. This is a classic information disclosure vulnerability with network-accessible attack surface (AV:N) requiring no authentication (PR:N) and no user interaction (UI:N).

RemediationAI

Apply the patch issued by HCL for BigFix Service Management as documented in vendor advisory KB0128144 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144). The patch adds proper input validation and exception handling to the consumer_company parameter in the reporting module, preventing error messages from leaking sensitive details. As an interim compensating control, restrict access to the BigFix SM reporting module via network firewall rules or WAF policies to trusted IP ranges only, and enable HTTP response body filtering to suppress stack traces and debugging information from reaching end users. Consider deploying a reverse proxy with error page rewriting to mask backend exceptions. These controls reduce information leakage but do not address the root cause and may impact legitimate users requiring debugging access.