CVEvulnerability

CVE-2025-15634

5.3 MEDIUM Published 2026-05-09 Modified 2026-07-25 Official page ↗
Status
Analyzed
Published
2026-05-09
Last modified
2026-07-25
Assigner
[email protected]
CVSS 4.0 ([email protected])
5.3 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862

Description

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

Affected configurations

• hcltech bigfix webui api (< 33) • hcltech bigfix webui application administration (< 40) • hcltech bigfix webui cmep (< 22) • hcltech bigfix webui common (< 101) • hcltech bigfix webui content app (< 28) • hcltech bigfix webui custom (< 50) • hcltech bigfix webui data sync (< 37) • hcltech bigfix webui extensions (< 14) • hcltech bigfix webui framework (< 35) • hcltech bigfix webui insights (< 32) • hcltech bigfix webui ivr (< 23) • hcltech bigfix webui mdm (< 29) • hcltech bigfix webui patch (< 54) • hcltech bigfix webui patch policies (< 51) • hcltech bigfix webui permissions and preferences (< 27) • hcltech bigfix webui profile management (< 33) • hcltech bigfix webui query (< 45) • hcltech bigfix webui reports (< 24) • hcltech bigfix webui scm (< 20) • hcltech bigfix webui software distribution (< 54) • hcltech bigfix webui take action (< 37)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References