CVE-2025-15633
—CVSS 4.0
5.3 medium
EPSS
<1%p13
Published
()
Modified
Description
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
- Vendors
- hcltech
- Products
- bigfix webui api, bigfix webui application administration, bigfix webui cmep, bigfix webui common, bigfix webui content app, bigfix webui custom, bigfix webui data sync, bigfix webui extensions, bigfix webui framework, bigfix webui insights, bigfix webui ivr, bigfix webui mdm
- Weakness
- CWE-863
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news0 stories
No ingested article mentions this CVE yet.