Origin validation error in HCL Software BigFix SaaS Remediate
Priority LOW 38CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-346.
Summary
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00168 6th percentileScored 2026-11-07
Fix Fixed BigFix SaaS Remediate (HCL Software): 8.1.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HCL Software | BigFix SaaS Remediate | before 8.1.14 | 8.1.14 | Patch available | CNA |
- BigFix SaaS Remediate VendorHCL Software Affected before 8.1.14 Fixed in 8.1.14 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hcltech:bigfix_saas:*:*:*:*:*:*:*:* | before 8.1.14 | Vulnerable | HCL Software |
- cpe:2.3:a:hcltech:bigfix_saas:*:*:*:*:*:*:*:* Versions before 8.1.14 Vulnerable ·HCL Software
Remediation
- Fix · CNA BigFix SaaS Remediate (HCL Software) Fixed in 8.1.14
Timeline
- 2026-10-02 Threatist record created from CVE-2025-52621
- 2026-10-03 Alias added: GHSA-r9j3-884r-cxhp
References
More HCL Software Bigfix Saas vulnerabilities
- TI-2025-32697 SQL injection in HCL Software BigFix SaaS Remediate CVSS 3.1CRITICAL 9.8
- TI-2025-32698 Information disclosure through error messages in HCL Software BigFix SaaS Remediate CVSS 3.1MEDIUM 5.3
- TI-2025-32699 Improper input validation in HCL Software BigFix SaaS Remediate CVSS 3.1MEDIUM 5.4
Sources
- CVE-2025-52621 · CVE Program
- CVE-2025-52621 · NVD
- FIRST EPSS
- GHSA-r9j3-884r-cxhp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences