EUVD-2026-82767
GHSA-gm89-cfvp-mg6w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states an authenticated attacker, so PR:L over the vendor's PR:N; impacts are data extraction/cross-tenant PII (C:H) with only limited integrity from injection and no demonstrated availability loss.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
3DescriptionCVE.org
HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject database commands to extract sensitive system details, as well as manipulate request values to gain unauthorized access to full personal profile data and PII across different organizations.
AnalysisAI
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the application's request-handling layer to inject database commands and to manipulate tenant/organization scoping values so that another organization's profile data and PII can be read. The vendor rates this 9.8 Critical using a vector that encodes PR:N, but the advisory text itself states the attack requires an authenticated attacker - an internal contradiction; our independent assessment resolves it as AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, so exploitability hinges on whether a valid account is genuinely required, and the cross-tenant half of the impact only applies to multi-tenant deployments hosting multiple organizations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets HCL BigFix Service Management and requires reaching the vulnerable application request handling: (1) a parameter that flows unsanitized into a SQL query (the SQLi/CWE-89 primitive), and (2) the multi-tenant deployment mode where organization/tenant scoping can be bypassed by manipulating request values to reach another organization's profile/PII data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor scores this 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is a direct internal contradiction: the CVSS vector encodes PR:N (unauthenticated) while the description explicitly states an 'authenticated attacker.' This must be verified with HCL - if authentication is genuinely required, the honest privilege metric is PR:L and the score drops meaningfully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No fix version was disclosed in the provided intelligence, so the status is: No vendor-released patch identified at time of analysis - confirm the patched build and any upgrade instructions directly in HCL support article KB0133782 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782) before assuming no remediation exists. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HCL BigFix Service Management deployments, identify multi-tenant instances and any internet-facing request-handling layer, restrict network access to trusted sources, enforce MFA and least privilege, and enable detailed logging for SQL injection and cross-tenant scoping attempts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct s
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Same weakness CWE-89 – SQL Injection
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today