EUVD-2026-90903
GHSA-fv76-gg4w-xxw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed API over network
-
DeliverySend unauthenticated request to endpoint
-
ExploitEndpoint returns internal database info
-
ExecutionHarvest schema/connection details
-
ImpactPlan targeted database attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the HCL BigFix Service Management application's exposed API endpoint; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed. The vendor description does not name a specific configuration toggle, so the endpoint appears reachable in standard deployments, but the input does not confirm whether the management interface is internet-facing or segmented to an internal admin network - the primary limiting factor is network exposure, since instances restricted to trusted internal networks sharply reduce the attacker population. Impact is confined to disclosure of internal database information (C:L), not write access or code execution, which limits direct damage to reconnaissance value. |
| Impact | This is a moderate-severity information disclosure flaw (CVSS 5.3) whose signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a network-reachable, low-complexity, unauthenticated exposure with no user interaction, which is why the SSVC framework marks it Automatable: yes - the exposed API endpoint can be queried at scale by scripts. However, the impact is deliberately bounded: only confidentiality is affected and only at a Low level (C:L/I:N/A:N), matching the SSVC Technical Impact of 'partial' and CWE-200. Critically, SSVC Exploitation is 'none' and there is no CISA KEV listing and no public exploit, so despite being easily automatable this is not currently being exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The honest characterization is a real-but-bounded hygiene issue: it is unauthenticated and automatable (favoring prompt patching), but it leaks internal database metadata rather than granting direct access, serving as a reconnaissance aid for follow-on targeted database attacks rather than a standalone high-impact compromise. Treat as a prioritized-but-not-emergency fix. |
| Exploit ScenarioDerived | An unauthenticated attacker on a network path to the HCL BigFix Service Management instance sends a request to the exposed API endpoint and receives sensitive internal database information in the response. No public exploit code has been identified, but the SSVC 'Automatable: yes' rating means the request could be scripted and run broadly. The leaked schema/connection details would then be used to plan a more precise, targeted attack against the backend database. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unauthenticated callers (CVSS 5.3, AV:N/AC:L/PR:N/UI:N), giving attackers reconnaissance material that could support follow-on targeted database attacks. Impact is limited to confidentiality (C:L) with no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis; exploitation is assessed as network-reachable and automatable, so the practical risk depends heavily on whether the management interface is internet-facing or confined to a trusted internal segment.
RemediationAI
The provided intelligence contains no fixed version identifier, so a patched release cannot be confirmed from the available data; treat the vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015 as the authoritative source for a fix, and apply the vendor-supplied update as soon as one is published, noting that patch availability is not independently confirmed here. Until then, the highest-value compensating control is network scoping: place the BigFix Service Management application and its API behind a management VLAN, VPN, or jump host so the endpoint is not reachable from untrusted networks, applying the same restriction to any reverse proxy or load balancer fronting it - the trade-off is that remote administrators and API integrations must connect through the VPN or bastion, which adds latency and an access-management dependency. As a secondary measure, block or deny-list the specific endpoint path at the reverse proxy, WAF, or firewall layer for non-administrative source addresses, accepting that legitimate integrations using that endpoint will break and that path-based filtering requires updating if the endpoint URI changes. Because exploitation requires no authentication, also review web and API access logs for unauthenticated requests that return database-related content, rotate or restrict any database credentials or connection details that may have been exposed, and verify the database is not directly reachable from the same segment as the application. General hardening such as restricting database listener exposure, enforcing least privilege on the application's database account, and alerting on anomalous schema or metadata enumeration queries reduces the value of any reconnaissance obtained before a patch is applied.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) rooted in an API endpoint of the HCL BigFix Service Management application that returns internal database details as part of its response without adequate access control or response redaction. Because the assessed CVSS vector carries PR:N and UI:N, the endpoint can be queried by an unauthenticated remote client over the network with no user interaction, which places the root cause in the authorization/response-filtering layer of the application's API rather than in a memory-safety or injection defect. The disclosed material is described as sensitive internal database information, which characteristically means schema, configuration, or connection-related details that are useful for mapping the backend before attempting more targeted database attacks; there is no evidence in the available data of write access, query execution, or code execution, so the primitive is one of reconnaissance rather than direct compromise. The CPE entry cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*:*:*:*:*:*:*:* uses a wildcard version, so the affected release range is not pinned by the CPE string and must be taken from the vendor advisory. SSVC scoring from CISA lists Exploitation as none, Automatable as yes, and Technical Impact as partial, which aligns with a moderate-severity disclosure whose value is primarily to an attacker performing pre-attack enumeration.
Know when Hcl Bigfix Service Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated network-reachable API (AV:N/AC:L/PR:N/UI:N) leaking limited internal DB metadata gives C:L with no integrity or availability impact and no scope change.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive internal database information. This information could enable an attacker to facilitate targeted database attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attac
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the applic
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the pro
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive da
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error mes
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one ten
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the appl
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly valida
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple si
Exploit-DB