EUVD-2026-90877
GHSA-95qm-c6pj-569j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public web front-end
-
ExploitDownload exposed JavaScript bundles
-
ExecutionParse for hidden admin API paths
-
ImpactEnumerate discovered endpoints for targeted follow-on attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an internet-reachable or otherwise network-accessible HCL BigFix Service Management web interface that serves client-side JavaScript files referencing administrative API endpoints. No authentication, privileges, or user interaction are needed (PR:N/UI:N), so default deployments that expose their front-end assets are affected. The practical limiting factor is impact scope: the vulnerability only reveals endpoint names/paths (C:L, no I/A impact) and yields no sensitive data by itself - meaningful damage requires the discovered endpoints to be separately exploitable, which this issue does not provide. |
| Impact | This is a low-severity reconnaissance/information-disclosure issue, not a direct-impact vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) accurately reflects an unauthenticated, network-reachable weakness with only limited confidentiality impact and no integrity or availability impact. The disclosure itself does not expose sensitive user data - it merely reveals the existence/paths of hidden administrative API endpoints embedded in publicly served JavaScript, which an attacker could then probe. No EPSS score, CISA KEV listing, or public POC is provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Real-world priority is LOW: the flaw is a stepping stone for targeted reconnaissance rather than a standalone breach, and the true danger depends entirely on whether those discovered admin endpoints are themselves inadequately protected (which this CVE does not establish). No signals conflict - the single vendor source (HCL) and the CVSS vector are internally consistent. |
| Exploit ScenarioDerived | An unauthenticated attacker retrieves the publicly accessible front-end JavaScript bundles of an HCL BigFix Service Management instance and parses them for references to undocumented or hidden administrative API routes. Having mapped these endpoints, the attacker directs targeted follow-on probing (e.g., auth or authorization testing) against them. No public exploit code is identified at time of analysis; the technique requires only a browser and standard JS static-analysis tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden administrative API endpoint paths, a low-severity reconnaissance issue that leaks endpoint names without exposing sensitive data, altering data, or causing denial of service. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N confirms no authentication or user interaction is required, but impact is limited to low confidentiality loss; no public exploit code or active exploitation has been identified at time of analysis. The disclosure is only useful if the discovered endpoints have separate exploitable flaws, which this CVE does not provide.
RemediationAI
No vendor-released patch version is specified in the provided data, so the first step is to review HCL advisory KB0134015 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015 for current fix or upgrade guidance. Until a vendor fix is applied, reduce exposure by ensuring administrative API endpoints enforce authentication and authorization server-side regardless of whether their paths are discoverable, and consider removing unnecessary administrative endpoint references from client-side JavaScript bundles where doing so does not break application functionality. If management interfaces do not need to be internet-reachable, restrict them to trusted networks or VPN; this may limit legitimate remote user access. Log and alert on enumeration of non-public API paths to detect follow-on reconnaissance. Do not rely on JavaScript obfuscation as a primary control, because it only raises the effort required to extract endpoint names and does not remediate the information disclosure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BigFix Service Management is a web-facing IT service management component in the HCL BigFix suite. The issue arises because client-side JavaScript assets, which must be delivered to the browser for the application to function, include references to administrative API endpoints. Because these files are publicly accessible, an attacker can parse them without authenticating and map internal or administrative API routes. The root-cause class is CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, specifically information leakage through client-side code. The CPE cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*:*:*:*:*:*:*:* uses a wildcard version, so the provided data does not pin affected releases. The assessed vector PR:N/UI:N confirms this is remotely reachable without credentials or user interaction, but the C:L rating and absence of I/A impact mean the disclosure is endpoint metadata only, not credential, data, or code-execution exposure.
Know when Hcl Bigfix Service Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote retrieval of public JS (AV:N/AC:L/PR:N/UI:N) yields only limited information disclosure (C:L), with no integrity or availability impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attac
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the applic
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the pro
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unau
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive da
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error mes
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one ten
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the appl
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly valida
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple si
Exploit-DB