{"id":"CVE-2025-15634","aliases":["EUVD-2025-209754","GHSA-957m-p4pq-mxmf"],"status":"published","title":"HCL BigFix WebUI is affected by a missing authorization vulnerability","description":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.","severity":{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0018,"percentile":0.07608,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-05-09T05:05:33Z","modified":"2026-07-25T11:10:00Z","products":[{"vendor":"hclsoftware","product":"bigfix webui"},{"vendor":"hcltech","product":"bigfix_webui_api"},{"vendor":"hcltech","product":"bigfix_webui_application_administration"},{"vendor":"hcltech","product":"bigfix_webui_cmep"},{"vendor":"hcltech","product":"bigfix_webui_common"},{"vendor":"hcltech","product":"bigfix_webui_content_app"},{"vendor":"hcltech","product":"bigfix_webui_custom"},{"vendor":"hcltech","product":"bigfix_webui_data_sync"},{"vendor":"hcltech","product":"bigfix_webui_extensions"},{"vendor":"hcltech","product":"bigfix_webui_framework"},{"vendor":"hcltech","product":"bigfix_webui_insights"},{"vendor":"hcltech","product":"bigfix_webui_ivr"},{"vendor":"hcltech","product":"bigfix_webui_mdm"},{"vendor":"hcltech","product":"bigfix_webui_patch"},{"vendor":"hcltech","product":"bigfix_webui_patch_policies"},{"vendor":"hcltech","product":"bigfix_webui_permissions_and_preferences"},{"vendor":"hcltech","product":"bigfix_webui_profile_management"},{"vendor":"hcltech","product":"bigfix_webui_query"},{"vendor":"hcltech","product":"bigfix_webui_reports"},{"vendor":"hcltech","product":"bigfix_webui_scm"},{"vendor":"hcltech","product":"bigfix_webui_software_distribution"},{"vendor":"hcltech","product":"bigfix_webui_take_action"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0130587","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15634"},{"url":"https://github.com/advisories/GHSA-957m-p4pq-mxmf"}],"sources":{"cve":[{"id":"CVE-2025-15634","title":"HCL BigFix WebUI is affected by a missing authorization vulnerability","description":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.","status":"published","published":"2026-05-09T05:05:33.534Z","modified":"2026-05-11T15:20:56.101Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:32:37.680845Z"}],"euvd":[{"id":"EUVD-2025-209754","description":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.","status":"published","published":"2026-05-09T05:05:33Z","modified":"2026-05-11T15:20:56Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:05:10.736891Z"}],"ghsa":[{"id":"GHSA-957m-p4pq-mxmf","title":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without...","description":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.","status":"published","published":"2026-05-09T06:31:36Z","modified":"2026-05-14T21:31:41Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:08:09.535348Z"}],"nvd":[{"id":"CVE-2025-15634","description":"A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direct URL access to the unauthorized page.","status":"published","published":"2026-05-09T06:16:09.13Z","modified":"2026-07-25T11:10:00.1Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:02.090779Z"}]}}