CVE-2025-31985
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Missing or insecure X-Content-Type-Options header in HCL BigFix Service Management (SM) allows browsers to perform MIME-type sniffing. This could cause malicious content to be interpreted and executed incorrectly.
Risk Assessment
An attacker could inject malicious code that gets executed in the victim's browser, potentially leading to data theft or session hijacking.
Recommendation
Configure the server to send the X-Content-Type-Options: nosniff header for all responses.
Original NVD description (English source)
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This could allow browsers to perform MIME-type sniffing, potentially causing malicious content to be interpreted and executed incorrectly.