CVE-2025-15633
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Fraqueza
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Produtos afetados
- hcltech bigfix_webui_api
- hcltech bigfix_webui_application_administration
- hcltech bigfix_webui_cmep
- hcltech bigfix_webui_common
- hcltech bigfix_webui_content_app
- hcltech bigfix_webui_custom
- hcltech bigfix_webui_data_sync
- hcltech bigfix_webui_extensions
Referências
Encontre a falha antes de um atacante.
Entre com o GitHub e rode sua primeira auditoria em menos de um minuto. O plano gratuito não exige cartão de crédito.