Bigfix Service Management Sm
Monthly
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
HCL BigFix Service Management (SM) version 23 ships with - or can be deployed in - a state where the host root filesystem is mounted writable instead of read-only, allowing an attacker who already holds high privileges on that host to modify critical system components that should be immutable. The impact is a hardening deficiency that amplifies an existing foothold rather than a way to gain initial access: remediation requires prior high-privileged (PR:H) access to the local host, and no public exploit code or confirmed active exploitation exists (EPSS 0.03%, 8th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial). This is best treated as a low-priority, defense-in-depth finding despite its 7.2 (High) nominal CVSS.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) server component, which can expose the application to the known security weaknesses of that unnamed server release and potentially enable unauthorized access or information disclosure. Exploitation requires a network-reachable deployment of the affected SM web front end and a low-privileged authenticated position per the CVSS vector (PR:L), and its real-world risk is gated by whatever specific flaws exist in the pinned WSGI version rather than by a documented, directly triggerable bug. No public exploit code or confirmed active exploitation has been identified (CISA SSVC rates exploitation 'none' and automatable 'no'), and EPSS is very low at 0.02% (7th percentile), so this should be treated as a component-currency and hardening issue rather than an urgent, weaponized threat.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-site scripting (XSS) attacks. Authenticated users with low privileges can inject malicious scripts by exploiting insufficient CSP directives, potentially exposing sensitive information or hijacking user sessions. The vulnerability requires user interaction (UI:R) and operates in a non-global scope, limiting but not eliminating real-world risk.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers to passively intercept and read sensitive data in transit without authentication or user interaction. The vulnerability exposes confidential information including credentials and system details to packet sniffing attacks on any network where the service is accessible.
HTTP request smuggling in HCL BigFix Service Management (SM) 23 allows unauthenticated remote attackers to bypass front-end security controls, poison caches, or hijack requests when the product is deployed behind a front-end HTTP server or proxy that parses requests differently than the back-end. Exploitation requires this specific desynchronized topology (high complexity per independent assessment), and no public exploit or active exploitation has been identified; EPSS is 0.03% (8th percentile), indicating very low likelihood of exploitation at this time.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
HCL BigFix Service Management (SM) version 23 ships with - or can be deployed in - a state where the host root filesystem is mounted writable instead of read-only, allowing an attacker who already holds high privileges on that host to modify critical system components that should be immutable. The impact is a hardening deficiency that amplifies an existing foothold rather than a way to gain initial access: remediation requires prior high-privileged (PR:H) access to the local host, and no public exploit code or confirmed active exploitation exists (EPSS 0.03%, 8th percentile; SSVC Exploitation: none, Automatable: no, Technical Impact: partial). This is best treated as a low-priority, defense-in-depth finding despite its 7.2 (High) nominal CVSS.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) server component, which can expose the application to the known security weaknesses of that unnamed server release and potentially enable unauthorized access or information disclosure. Exploitation requires a network-reachable deployment of the affected SM web front end and a low-privileged authenticated position per the CVSS vector (PR:L), and its real-world risk is gated by whatever specific flaws exist in the pinned WSGI version rather than by a documented, directly triggerable bug. No public exploit code or confirmed active exploitation has been identified (CISA SSVC rates exploitation 'none' and automatable 'no'), and EPSS is very low at 0.02% (7th percentile), so this should be treated as a component-currency and hardening issue rather than an urgent, weaponized threat.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-site scripting (XSS) attacks. Authenticated users with low privileges can inject malicious scripts by exploiting insufficient CSP directives, potentially exposing sensitive information or hijacking user sessions. The vulnerability requires user interaction (UI:R) and operates in a non-global scope, limiting but not eliminating real-world risk.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers to passively intercept and read sensitive data in transit without authentication or user interaction. The vulnerability exposes confidential information including credentials and system details to packet sniffing attacks on any network where the service is accessible.
HTTP request smuggling in HCL BigFix Service Management (SM) 23 allows unauthenticated remote attackers to bypass front-end security controls, poison caches, or hijack requests when the product is deployed behind a front-end HTTP server or proxy that parses requests differently than the back-end. Exploitation requires this specific desynchronized topology (high complexity per independent assessment), and no public exploit or active exploitation has been identified; EPSS is 0.03% (8th percentile), indicating very low likelihood of exploitation at this time.