CVE-2025-15633
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
弱点类型
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
受影响产品
- hcltech bigfix_webui_api
- hcltech bigfix_webui_application_administration
- hcltech bigfix_webui_cmep
- hcltech bigfix_webui_common
- hcltech bigfix_webui_content_app
- hcltech bigfix_webui_custom
- hcltech bigfix_webui_data_sync
- hcltech bigfix_webui_extensions