medium6.5
CVE-2025-15633
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names…
Impact
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hcltech | Bigfix Webui Api | before 33 |
| Hcltech | Bigfix Webui Application Administration | before 40 |
| Hcltech | Bigfix Webui Cmep | before 22 |
| Hcltech | Bigfix Webui Common | before 101 |
| Hcltech | Bigfix Webui Content App | before 28 |
| Hcltech | Bigfix Webui Custom | before 50 |
| Hcltech | Bigfix Webui Data Sync | before 37 |
| Hcltech | Bigfix Webui Extensions | before 14 |
| Hcltech | Bigfix Webui Framework | before 35 |
| Hcltech | Bigfix Webui Insights | before 32 |
| Hcltech | Bigfix Webui Ivr | before 23 |
| Hcltech | Bigfix Webui Mdm | before 29 |