CVE-2025-15633
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, configuration variables) via unprotected endpoints lacking adequate security headers.
Risk Assessment
Breach of confidentiality of configuration data and infrastructure information, which may facilitate further attacks on the BigFix system.
Recommendation
Contact HCL for a patch. Temporarily restrict access to WebUI to trusted users and networks.
Original NVD description (English source)
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.