CVE-2025-15633
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Weakness
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Affected products
- hcltech bigfix_webui_api
- hcltech bigfix_webui_application_administration
- hcltech bigfix_webui_cmep
- hcltech bigfix_webui_common
- hcltech bigfix_webui_content_app
- hcltech bigfix_webui_custom
- hcltech bigfix_webui_data_sync
- hcltech bigfix_webui_extensions
References
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.