5.3Medium
CVE-2025-15634HCL BigFix WebUI is affected by a missing authorization vulnerability
Description
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.
Weakness (CWE):
CWE-862
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| HCLSoftware | BigFix WebUI | all versions | |
| hcltech | bigfix webui api | < 33 | |
| hcltech | bigfix webui application administration | < 40 | |
| hcltech | bigfix webui cmep | < 22 | |
| hcltech | bigfix webui common | < 101 | |
| hcltech | bigfix webui content app | < 28 | |
| hcltech | bigfix webui custom | < 50 | |
| hcltech | bigfix webui data sync | < 37 | |
| hcltech | bigfix webui extensions | < 14 | |
| hcltech | bigfix webui framework | < 35 | |
| hcltech | bigfix webui insights | < 32 | |
| hcltech | bigfix webui ivr | < 23 | |
| hcltech | bigfix webui mdm | < 29 | |
| hcltech | bigfix webui patch | < 54 | |
| hcltech | bigfix webui patch policies | < 51 | |
| hcltech | bigfix webui permissions and preferences | < 27 | |
| hcltech | bigfix webui profile management | < 33 | |
| hcltech | bigfix webui query | < 45 | |
| hcltech | bigfix webui reports | < 24 | |
| hcltech | bigfix webui scm | < 20 | |
| hcltech | bigfix webui software distribution | < 54 | |
| hcltech | bigfix webui take action | < 37 |
References and patches
CPE matches (NVD) (21)
cpe:2.3:a:hcltech:bigfix_webui_api:*:*:*:*:*:*:*:*< 33cpe:2.3:a:hcltech:bigfix_webui_application_administration:*:*:*:*:*:*:*:*< 40cpe:2.3:a:hcltech:bigfix_webui_cmep:*:*:*:*:*:*:*:*< 22cpe:2.3:a:hcltech:bigfix_webui_common:*:*:*:*:*:*:*:*< 101cpe:2.3:a:hcltech:bigfix_webui_content_app:*:*:*:*:*:*:*:*< 28cpe:2.3:a:hcltech:bigfix_webui_custom:*:*:*:*:*:*:*:*< 50cpe:2.3:a:hcltech:bigfix_webui_data_sync:*:*:*:*:*:*:*:*< 37cpe:2.3:a:hcltech:bigfix_webui_extensions:*:*:*:*:*:*:*:*< 14cpe:2.3:a:hcltech:bigfix_webui_framework:*:*:*:*:*:*:*:*< 35cpe:2.3:a:hcltech:bigfix_webui_insights:*:*:*:*:*:*:*:*< 32cpe:2.3:a:hcltech:bigfix_webui_ivr:*:*:*:*:*:*:*:*< 23cpe:2.3:a:hcltech:bigfix_webui_mdm:*:*:*:*:*:*:*:*< 29cpe:2.3:a:hcltech:bigfix_webui_patch:*:*:*:*:*:*:*:*< 54cpe:2.3:a:hcltech:bigfix_webui_patch_policies:*:*:*:*:*:*:*:*< 51cpe:2.3:a:hcltech:bigfix_webui_permissions_and_preferences:*:*:*:*:*:*:*:*< 27cpe:2.3:a:hcltech:bigfix_webui_profile_management:*:*:*:*:*:*:*:*< 33cpe:2.3:a:hcltech:bigfix_webui_query:*:*:*:*:*:*:*:*< 45cpe:2.3:a:hcltech:bigfix_webui_reports:*:*:*:*:*:*:*:*< 24cpe:2.3:a:hcltech:bigfix_webui_scm:*:*:*:*:*:*:*:*< 20cpe:2.3:a:hcltech:bigfix_webui_software_distribution:*:*:*:*:*:*:*:*< 54cpe:2.3:a:hcltech:bigfix_webui_take_action:*:*:*:*:*:*:*:*< 37