EUVD-2025-209687Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
AnalysisAI
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
Technical ContextAI
CSRF vulnerabilities (CWE-352) occur when web applications accept state-changing requests without verifying that the request originated from the legitimate user. HCL BigFix Service Management, an IT service management platform, fails to implement proper anti-CSRF protections such as synchronization tokens or SameSite cookie attributes. An authenticated user with login privileges could be tricked into initiating unintended actions on the platform. The vulnerability affects all versions of the product according to the CPE specification (cpe:2.3:a:hcl_software:bigfix_service_management_(sm):*:*:*:*:*:*:*:*), though patch versions may exist.
RemediationAI
Apply the security patch released by HCL, available at the vendor advisory URL: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144. Consult this advisory for the specific patched version applicable to your installation. Until patches can be deployed, implement compensating controls: enable SameSite cookie attributes (set to 'Strict' or 'Lax') on all BigFix SM session cookies to prevent CSRF attacks across cross-site scenarios; implement Content Security Policy (CSP) headers to restrict form submissions to same-origin requests; educate users on avoiding suspicious links in emails or messages that claim to be from IT administration; and consider restricting access to BigFix SM administrative functions to internal networks only using firewall or VPN rules. Note that these controls do not fully eliminate the vulnerability and are temporary measures pending patch deployment.
More in Bigfix Service Management Sm
View allHCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a b
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers
HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the applicat
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated
HCL BigFix Service Management is vulnerable to improper root filesystem configuration, allowing high-privileged authenti
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type s
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-s
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadver
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today