CVE-2025-52621: medium-severity vulnerability in HCL Software BigFix SaaS Remediate
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.2%
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
HCL Software · BigFix SaaS RemediateRelated CVEs — HCL Software BigFix SaaS Remediate
In the same product, most dangerous first.
CVE-2025-52618MEDIUMHCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerabilityEPSS 0.4%CVE-2025-52619MEDIUMHCL BigFix SaaS Authentication Service is affected by a sensitive information disclosureEPSS 0.3%CVE-2025-52620MEDIUMHCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-52622MEDIUMHCL BigFix SaaS Remediate is affected by a security vulnerabilityEPSS 0.2%