CVE-2025-15634
5.3
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow more
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: psirt@hcl.com (Secondary)
Description
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
Affected (21)
Products: Hcltech: Bigfix Webui Api, Bigfix Webui Application Administration, Bigfix Webui Cmep, Bigfix Webui Common, Bigfix Webui Content App, Bigfix Webui Custom, Bigfix Webui Data Sync, Bigfix Webui Extensions, Bigfix Webui Framework, Bigfix Webui Insights, Bigfix Webui Ivr, Bigfix Webui Mdm, Bigfix Webui Patch, Bigfix Webui Patch Policies, Bigfix Webui Permissions And Preferences, Bigfix Webui Profile Management, Bigfix Webui Query, Bigfix Webui Reports, Bigfix Webui Scm, Bigfix Webui Software Distribution, Bigfix Webui Take Action
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 33 | |
| Before 40 | |
| Before 22 | |
| Before 101 | |
| Before 28 | |
| Before 50 | |
| Before 37 | |
| Before 14 | |
| Before 35 | |
| Before 32 | |
| Before 23 | |
| Before 29 | |
| Before 54 | |
| Before 51 | |
| Before 27 | |
| Before 33 | |
| Before 45 | |
| Before 24 | |
| Before 20 | |
| Before 54 | |
| Before 37 |
References (1)
Source: psirt@hcl.com
Vendor Advisory
Timeline
No history available yet.