5.3Medium
CVE-2025-15633HCL BigFix WebUI is affected by an improper authorization vulnerability
Description
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Weakness (CWE):
CWE-863
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| HCLSoftware | BigFix WebUI | all versions | |
| hcltech | bigfix webui api | < 33 | |
| hcltech | bigfix webui application administration | < 40 | |
| hcltech | bigfix webui cmep | < 22 | |
| hcltech | bigfix webui common | < 101 | |
| hcltech | bigfix webui content app | < 28 | |
| hcltech | bigfix webui custom | < 50 | |
| hcltech | bigfix webui data sync | < 37 | |
| hcltech | bigfix webui extensions | < 14 | |
| hcltech | bigfix webui framework | < 35 | |
| hcltech | bigfix webui insights | < 32 | |
| hcltech | bigfix webui ivr | < 23 | |
| hcltech | bigfix webui mdm | < 29 | |
| hcltech | bigfix webui patch | < 54 | |
| hcltech | bigfix webui patch policies | < 51 | |
| hcltech | bigfix webui permissions and preferences | < 27 | |
| hcltech | bigfix webui profile management | < 33 | |
| hcltech | bigfix webui query | < 45 | |
| hcltech | bigfix webui reports | < 24 | |
| hcltech | bigfix webui scm | < 20 | |
| hcltech | bigfix webui software distribution | < 54 | |
| hcltech | bigfix webui take action | < 37 |
References and patches
CPE matches (NVD) (21)
cpe:2.3:a:hcltech:bigfix_webui_api:*:*:*:*:*:*:*:*< 33cpe:2.3:a:hcltech:bigfix_webui_application_administration:*:*:*:*:*:*:*:*< 40cpe:2.3:a:hcltech:bigfix_webui_cmep:*:*:*:*:*:*:*:*< 22cpe:2.3:a:hcltech:bigfix_webui_common:*:*:*:*:*:*:*:*< 101cpe:2.3:a:hcltech:bigfix_webui_content_app:*:*:*:*:*:*:*:*< 28cpe:2.3:a:hcltech:bigfix_webui_custom:*:*:*:*:*:*:*:*< 50cpe:2.3:a:hcltech:bigfix_webui_data_sync:*:*:*:*:*:*:*:*< 37cpe:2.3:a:hcltech:bigfix_webui_extensions:*:*:*:*:*:*:*:*< 14cpe:2.3:a:hcltech:bigfix_webui_framework:*:*:*:*:*:*:*:*< 35cpe:2.3:a:hcltech:bigfix_webui_insights:*:*:*:*:*:*:*:*< 32cpe:2.3:a:hcltech:bigfix_webui_ivr:*:*:*:*:*:*:*:*< 23cpe:2.3:a:hcltech:bigfix_webui_mdm:*:*:*:*:*:*:*:*< 29cpe:2.3:a:hcltech:bigfix_webui_patch:*:*:*:*:*:*:*:*< 54cpe:2.3:a:hcltech:bigfix_webui_patch_policies:*:*:*:*:*:*:*:*< 51cpe:2.3:a:hcltech:bigfix_webui_permissions_and_preferences:*:*:*:*:*:*:*:*< 27cpe:2.3:a:hcltech:bigfix_webui_profile_management:*:*:*:*:*:*:*:*< 33cpe:2.3:a:hcltech:bigfix_webui_query:*:*:*:*:*:*:*:*< 45cpe:2.3:a:hcltech:bigfix_webui_reports:*:*:*:*:*:*:*:*< 24cpe:2.3:a:hcltech:bigfix_webui_scm:*:*:*:*:*:*:*:*< 20cpe:2.3:a:hcltech:bigfix_webui_software_distribution:*:*:*:*:*:*:*:*< 54cpe:2.3:a:hcltech:bigfix_webui_take_action:*:*:*:*:*:*:*:*< 37