What is the CVSS score of EUVD-2025-209701?

EUVD-2025-209701 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

HCL BigFix Service Management EUVD-2025-209701

| CVE-2025-31984 LOW

Information Exposure (CWE-200)

2026-05-06 HCL

GHSA-jfx8-f9m6-qfgw

Information Disclosure Bigfix Service Management Sm

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 15:00 vuln.today

DescriptionCVE.org

HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.

AnalysisAI

HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.

Technical ContextAI

The X-Content-Type-Options HTTP response header (specifically the 'nosniff' directive) prevents MIME-type sniffing attacks where browsers guess the content type of resources instead of respecting server-declared types. HCL BigFix Service Management fails to set this header on HTTP responses, allowing an authenticated user with user interaction to trigger browser interpretation of malicious content (e.g., serving JavaScript as text/html). This is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), which covers security configuration issues that expose data or functionality. The affected product is HCL BigFix Service Management (all versions indicated by CPE wildcard matching).

RemediationAI

Upgrade HCL BigFix Service Management to a patched version released by HCL (exact version numbers not specified in available advisory - consult KB0128144 for the specific fix version applicable to your deployment). Ensure your installation receives the security update that includes the X-Content-Type-Options: nosniff header in HTTP responses. If patching cannot be applied immediately, configure web application firewalls or reverse proxies (if deployed behind one) to inject the X-Content-Type-Options: nosniff header into all BigFix SM responses, though this workaround does not address the underlying misconfiguration and may be bypassed if clients connect directly to the application. Additionally, restrict BigFix SM access to internal networks or behind authentication gateways to reduce exposure to unauthenticated attack surface, minimizing scenarios where users interact with untrusted content.