CVSS 4.0
5.3 mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2025-15634
Medium (5.3) in hcltech. EPSS 0.2% chance of exploitation in the next 30 days.
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
Severity
CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-11-01)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hcltech:bigfix_webui_api
- hcltech:bigfix_webui_application_administration
- hcltech:bigfix_webui_cmep
- hcltech:bigfix_webui_common
- hcltech:bigfix_webui_content_app
- hcltech:bigfix_webui_custom
- hcltech:bigfix_webui_data_sync
- hcltech:bigfix_webui_extensions
- hcltech:bigfix_webui_framework
- hcltech:bigfix_webui_insights
- hcltech:bigfix_webui_ivr
- hcltech:bigfix_webui_mdm
- hcltech:bigfix_webui_patch
- hcltech:bigfix_webui_patch_policies
- hcltech:bigfix_webui_permissions_and_preferences
- hcltech:bigfix_webui_profile_management
- hcltech:bigfix_webui_query
- hcltech:bigfix_webui_reports
- hcltech:bigfix_webui_scm
- hcltech:bigfix_webui_software_distribution
- hcltech:bigfix_webui_take_action