EUVD-2026-90904
GHSA-6rrg-p5fq-c993
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed BigFix Service Management API
-
DeliverySend crafted invalid input to endpoint
-
ExploitTrigger verbose error response
-
ExecutionHarvest leaked sensitive details
-
ImpactUse intel to plan follow-on attacks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires that one or more of the affected BigFix Service Management API endpoints be network-reachable by the attacker, and that the application be running in a mode that returns detailed (non-sanitized) error output when it receives invalid input - the core precondition named in the description is simply that invalid inputs reach 'certain API endpoints' and the application responds with sensitive data in the error. Limiting factors: impact is confidentiality-only (C:L) with no write or execution capability; the vendor-assessed AC:H and SSVC 'Automatable: no' imply the useful data is not reliably or uniformly leaked, so success may depend on which endpoint and input are probed; value is limited to reconnaissance that facilitates further attacks rather than direct compromise. |
| Impact | This is a low-priority issue despite being network-reachable without authentication. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects limited, confidentiality-only impact (C:L) with no integrity or availability effect, and the vendor-assigned high attack complexity (AC:H) further constrains practical exploitation. All three SSVC signals agree with this low urgency: Exploitation is 'none' (no observed activity), Automatable is 'no', and Technical Impact is only 'partial'. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV nor is any POC referenced, so there is no evidence of real-world exploitation. The only signal in tension is AV:N/PR:N, which makes the flaw remotely reachable by unauthenticated actors - but the payoff (verbose error-message data) is an information-leak that aids reconnaissance rather than a directly damaging primitive. Net: a genuine but minor hygiene issue, not an emergency; patch on a normal maintenance cycle. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends deliberately malformed or invalid requests to specific HCL BigFix Service Management API endpoints and harvests the verbose error responses, which disclose sensitive internal details (such as stack traces, internal paths, component versions, or configuration data). The attacker uses this leaked information to fingerprint the environment and plan follow-on attacks against other weaknesses. No public exploit code is referenced, and exploitation yields only information disclosure, not code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
BigFix Service Management API endpoints can disclose sensitive information in error messages when invalid input is submitted, enabling a remote, unauthenticated attacker to perform reconnaissance that may facilitate further attacks. Impact is limited to confidentiality (C:L), with no ability to modify data or execute code, and SSVC rates exploitation as not automatable with no public exploit identified at time of analysis. The vendor-assessed CVSS score is 3.7, while the assessed vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; the low severity and reconnaissance-only value make this a low-priority issue despite network reachability without authentication.
RemediationAI
Apply the fix or mitigation described in the vendor advisory HCL KB0134015 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015) as the primary remediation; the provided data does not include an exact fixed version, so the advisory should be checked for the applicable release. If an immediate update is not possible, reduce exposure by restricting network access to the affected API endpoints using firewall rules or ACLs so that only trusted management or integration hosts can reach them, recognizing that this may disrupt legitimate service management workflows. Configure the application to return generic error messages and disable detailed error output where possible, though this can hinder troubleshooting and is not a substitute for patching. Monitor application and API logs for probing patterns such as repeated invalid inputs that trigger error responses, and treat any disclosed sensitive details as an indicator of potential follow-on targeting. Because the flaw is confidentiality-only and has no known public exploit, these compensating controls should be weighed against operational impact.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is an instance of CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) arising from insufficient sanitization of error responses in HCL BigFix Service Management. The CPE string cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*:*:*:*:*:*:*:* uses a wildcard version, indicating the issue may affect multiple releases of the product. When certain API endpoints receive malformed or invalid input, the application returns error messages that include sensitive data such as internal paths, configuration details, or database information, rather than a generic error. This data has reconnaissance value for an attacker but does not by itself permit code execution, data modification, or privilege escalation. The SSVC decision framework rates technical impact as partial and exploitation as none, and notes the issue is not automatable, meaning an attacker likely must manually probe endpoints and craft inputs to obtain useful leakage.
Know when Hcl Bigfix Service Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Sending invalid input to an API to elicit a verbose error is trivial and unauthenticated (AC:L/PR:N/AV:N); impact is a limited confidentiality leak only (C:L, I/A:N).
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attac
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the applic
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the pro
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unau
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive da
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error mes
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one ten
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the appl
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly valida
Exploit-DB