CVEvulnerability

CVE-2025-0277

6.1 MEDIUM Published 2025-10-16 Modified 2026-10-08 Official page ↗
Status
Analyzed
Published
2025-10-16
Last modified
2026-10-08
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-693, CWE-79, CWE-80

Description

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

Affected configurations

• hcltech bigfix mobile (<= 3.3) • hcltech bigfix modern client management (< 3.4)

Related

Weakness · CWE (3)

  • CWE-693 Protection Mechanism Failure weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References