Read the docs
TI-2025-14262 Aliases CVE-2025-15634GHSA-957m-p4pq-mxmf

HCL BigFix WebUI is affected by a missing authorization vulnerability

Priority LOW 23CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0018 7th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HCL SoftwareBigFix WebUIall versions—No fix listedCNA
  • BigFix WebUI VendorHCL Software Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:bigfix_webui_api:*:*:*:*:*:*:*:*before 33VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_application_administration:*:*:*:*:*:*:*:*before 40VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_cmep:*:*:*:*:*:*:*:*before 22VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_common:*:*:*:*:*:*:*:*before 101VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_content_app:*:*:*:*:*:*:*:*before 28VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_custom:*:*:*:*:*:*:*:*before 50VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_data_sync:*:*:*:*:*:*:*:*before 37VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_extensions:*:*:*:*:*:*:*:*before 14VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_framework:*:*:*:*:*:*:*:*before 35VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_insights:*:*:*:*:*:*:*:*before 32VulnerableHCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_api:*:*:*:*:*:*:*:* Versions before 33 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_application_administration:*:*:*:*:*:*:*:* Versions before 40 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_cmep:*:*:*:*:*:*:*:* Versions before 22 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_common:*:*:*:*:*:*:*:* Versions before 101 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_content_app:*:*:*:*:*:*:*:* Versions before 28 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_custom:*:*:*:*:*:*:*:* Versions before 50 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_data_sync:*:*:*:*:*:*:*:* Versions before 37 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_extensions:*:*:*:*:*:*:*:* Versions before 14 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_framework:*:*:*:*:*:*:*:* Versions before 35 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_insights:*:*:*:*:*:*:*:* Versions before 32 Vulnerable ·HCL Software
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:bigfix_webui_ivr:*:*:*:*:*:*:*:*before 23VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_mdm:*:*:*:*:*:*:*:*before 29VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_patch:*:*:*:*:*:*:*:*before 54VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_patch_policies:*:*:*:*:*:*:*:*before 51VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_permissions_and_preferences:*:*:*:*:*:*:*:*before 27VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_profile_management:*:*:*:*:*:*:*:*before 33VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_query:*:*:*:*:*:*:*:*before 45VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_reports:*:*:*:*:*:*:*:*before 24VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_scm:*:*:*:*:*:*:*:*before 20VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_software_distribution:*:*:*:*:*:*:*:*before 54VulnerableHCL Software
cpe:2.3:a:hcltech:bigfix_webui_take_action:*:*:*:*:*:*:*:*before 37VulnerableHCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_ivr:*:*:*:*:*:*:*:* Versions before 23 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_mdm:*:*:*:*:*:*:*:* Versions before 29 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_patch:*:*:*:*:*:*:*:* Versions before 54 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_patch_policies:*:*:*:*:*:*:*:* Versions before 51 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_permissions_and_preferences:*:*:*:*:*:*:*:* Versions before 27 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_profile_management:*:*:*:*:*:*:*:* Versions before 33 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_query:*:*:*:*:*:*:*:* Versions before 45 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_reports:*:*:*:*:*:*:*:* Versions before 24 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_scm:*:*:*:*:*:*:*:* Versions before 20 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_software_distribution:*:*:*:*:*:*:*:* Versions before 54 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:bigfix_webui_take_action:*:*:*:*:*:*:*:* Versions before 37 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-15634
  2. 2026-10-03 Alias added: GHSA-957m-p4pq-mxmf

References

Advisory 1

  • TI-2025-14261 HCL BigFix WebUI is affected by an improper authorization vulnerability CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences