Strix
26.1K

CVE-2025-15633

MEDIUMCVSS 5.3/10EPSS 0.22%

Last modified

CVE-2025-15633 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 4.0
5.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.22%

13.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HcltechBigfix Webui Api< 33
HcltechBigfix Webui Application Administration< 40
HcltechBigfix Webui Cmep< 22
HcltechBigfix Webui Common< 101
HcltechBigfix Webui Content App< 28
HcltechBigfix Webui Custom< 50
HcltechBigfix Webui Data Sync< 37
HcltechBigfix Webui Extensions< 14
HcltechBigfix Webui Framework< 35
HcltechBigfix Webui Insights< 32
HcltechBigfix Webui Ivr< 23
HcltechBigfix Webui Mdm< 29
HcltechBigfix Webui Patch< 54
HcltechBigfix Webui Patch Policies< 51
HcltechBigfix Webui Permissions And Preferences< 27
HcltechBigfix Webui Profile Management< 33
HcltechBigfix Webui Query< 45
HcltechBigfix Webui Reports< 24
HcltechBigfix Webui Scm< 20
HcltechBigfix Webui Software Distribution< 54
HcltechBigfix Webui Take Action< 37

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2025-15633?
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
How severe is CVE-2025-15633?
CVE-2025-15633 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.
How do I fix CVE-2025-15633?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-15633?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST