Skip to content
Fencer Vulns
medium 6.5

CVE-2025-15633 json

HCL BigFix WebUI is affected by an improper authorization vulnerability

published 2026-05-09 6 mo ago modified 2026-07-25 3 mo ago also EUVD-2025-209753

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Patch / fix

  • hcltech bigfix_webui_api 33
  • hcltech bigfix_webui_application_administration 40
  • hcltech bigfix_webui_cmep 22
  • hcltech bigfix_webui_common 101
  • hcltech bigfix_webui_content_app 28
  • hcltech bigfix_webui_custom 50
  • hcltech bigfix_webui_data_sync 37
  • hcltech bigfix_webui_extensions 14
  • hcltech bigfix_webui_framework 35
  • hcltech bigfix_webui_insights 32
  • hcltech bigfix_webui_ivr 23
  • hcltech bigfix_webui_mdm 29
  • hcltech bigfix_webui_patch 54
  • hcltech bigfix_webui_patch_policies 51
  • hcltech bigfix_webui_permissions_and_preferences 27
  • hcltech bigfix_webui_profile_management 33
  • hcltech bigfix_webui_query 45
  • hcltech bigfix_webui_reports 24
  • hcltech bigfix_webui_scm 20
  • hcltech bigfix_webui_software_distribution 54

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.22% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CNA 4.0 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

  • HCLSoftware BigFix WebUI

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.