CVSS 4.0
5.3 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:NCVE-2025-15633
Medium (5.3) in hcltech. EPSS 0.2% chance of exploitation in the next 30 days.
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hcltech:bigfix_webui_api
- hcltech:bigfix_webui_application_administration
- hcltech:bigfix_webui_cmep
- hcltech:bigfix_webui_common
- hcltech:bigfix_webui_content_app
- hcltech:bigfix_webui_custom
- hcltech:bigfix_webui_data_sync
- hcltech:bigfix_webui_extensions
- hcltech:bigfix_webui_framework
- hcltech:bigfix_webui_insights
- hcltech:bigfix_webui_ivr
- hcltech:bigfix_webui_mdm
- hcltech:bigfix_webui_patch
- hcltech:bigfix_webui_patch_policies
- hcltech:bigfix_webui_permissions_and_preferences
- hcltech:bigfix_webui_profile_management
- hcltech:bigfix_webui_query
- hcltech:bigfix_webui_reports
- hcltech:bigfix_webui_scm
- hcltech:bigfix_webui_software_distribution
- hcltech:bigfix_webui_take_action