CVE-2025-15633: medium-severity vulnerability in HCLSoftware BigFix WebUI
HCL BigFix WebUI is affected by an improper authorization vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
HCLSoftware · BigFix WebUIRelated CVEs — HCLSoftware BigFix WebUI
In the same product, most dangerous first.