HCL BigFix Platform is affected by misconfigured security-related HTTP headers

The HCL BigFix Platform web interface is missing or incorrectly configured security headers in its HTTP responses. These headers help protect against common web attacks like clickjacking and data injection, so their absence weakens browser-level security protections.

The vulnerability stems from missing or misconfigured HTTP security headers (such as X-Frame-Options, Content-Security-Policy, X-Content-Type-Options) in web responses from the HCL BigFix Platform. An attacker can exploit this through client-side attacks (e.g., clickjacking, MIME-sniffing) if the application lacks proper header enforcement, affecting users who interact with the platform in a browser.