EUVD-2026-82784
GHSA-x4m7-q7pg-96vr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Network origin-reflection with AC:H and UI:R (victim must be logged in and visit attacker page); I keep C:L (not C:N) since CORS reflection can leak victim's authenticated API responses, plus I:L.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
3DescriptionCVE.org
HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application, enabling unauthorized access to protected resources and restricted APIs on behalf of a victim.
AnalysisAI
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly validated, allowing an attacker-controlled web page to issue credentialed cross-origin requests and read or manipulate protected resources and restricted APIs using an already-authenticated victim's session. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N, base 3.1) confirms the attacker needs no account on the application, but the attack only succeeds against a victim who is currently logged in to BigFix Service Management and is lured into visiting the malicious page in the same browser, which is why it is rated high complexity (AC:H). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a victim who is currently authenticated to HCL BigFix Service Management to visit an attacker-controlled web page in the same browser (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely low-priority issue and the signals are internally consistent about that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in HCL's advisory for KB0133917 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917); the available data does not include an exact patched version number, so confirm the fixed build for your release train with HCL Software support before upgrading, and treat the wildcard CPE as evidence that no version is explicitly declared safe yet - patch status is therefore 'per vendor advisory, exact version not independently confirmed.' If patching must be deferred, correct the server's CORS policy so Access-Control-Allow-Origin returns only a short explicit allowlist of trusted origins instead of reflecting arbitrary or wildcard values, and never combine a reflected origin with Access-Control-Allow-Credentials: true - the trade-off is that legitimate cross-domain integrations or embedded widgets from non-allowlisted origins will break until they are added. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cors Misconfiguration
View allCross-origin data theft in LightRAG server versions prior to 1.5.4 allows any malicious website to make authenticated, c
Casdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Unauthenticated cross-origin RCE in Windows ML CLI (winml-cli < 0.4.0) is reachable when a developer runs the `serve` co
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Share
External POC / Exploit Code
Leaving vuln.today