CVE-2025-15633
Estado: AnalizadaMedia (5.3)—
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers.
CVSS
- Versión: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Puntuación base: 5.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.22%
- Percentil entre todas las CVEs puntuadas: 12
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (21)
Hcltech — Bigfix Webui APIHcltech — Bigfix Webui Application AdministrationHcltech — Bigfix Webui CmepHcltech — Bigfix Webui CommonHcltech — Bigfix Webui Content APPHcltech — Bigfix Webui CustomHcltech — Bigfix Webui Data SyncHcltech — Bigfix Webui ExtensionsHcltech — Bigfix Webui FrameworkHcltech — Bigfix Webui InsightsHcltech — Bigfix Webui IVRHcltech — Bigfix Webui MDMHcltech — Bigfix Webui PatchHcltech — Bigfix Webui Patch PoliciesHcltech — Bigfix Webui Permissions AND PreferencesHcltech — Bigfix Webui Profile ManagementHcltech — Bigfix Webui QueryHcltech — Bigfix Webui ReportsHcltech — Bigfix Webui SCMHcltech — Bigfix Webui Software DistributionHcltech — Bigfix Webui Take Action
CWE
- CWE-863
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-15633",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-15633",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-05-11T17:29:56.867689Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 2.8
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 5.3,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "psirt@hcl.com",
"affectedData": [
{
"vendor": "HCLSoftware",
"product": "BigFix WebUI",
"versions": [
{
"status": "affected",
"version": "all versions"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-05-09T06:16:07.413",
"references": [
{
"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130587",
"tags": [
"Vendor Advisory"
],
"source": "psirt@hcl.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@hcl.com",
"description": [
{
"lang": "en",
"value": "CWE-863"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internal data (site names, versions, and configuration variables) and bypass privilege requirements via unprotected endpoints lacking adequate security headers."
},
{
"lang": "es",
"value": "Una vulnerabilidad de autorización impropia en HCL BigFix WebUI permite a un usuario autenticado sin privilegios de Operador Maestro acceder a datos internos (nombres de sitios, versiones y variables de configuración) y eludir los requisitos de privilegios a través de puntos finales desprotegidos que carecen de encabezados de seguridad adecuados."
}
],
"lastModified": "2026-07-25T11:10:00.100",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_api:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8680650F-B404-4812-AD8D-F93A7F52C20B",
"versionEndExcluding": "33"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_application_administration:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D8757E08-9B05-45FD-BEAC-7D27423C7FC4",
"versionEndExcluding": "40"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_cmep:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD60E500-25B7-42B4-8B0E-D84967B78AF4",
"versionEndExcluding": "22"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_common:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E6441EA2-8CF7-4A3B-8AD8-BBE2A62E5DF4",
"versionEndExcluding": "101"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_content_app:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFE1EED8-C5C9-47CD-B20E-E5D113B4DF48",
"versionEndExcluding": "28"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_custom:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "92437F31-8DD7-4440-AF6A-02B5DDA55A3F",
"versionEndExcluding": "50"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_data_sync:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F3C0E3C-1CE1-43FC-9B4C-8D0EE77E3E10",
"versionEndExcluding": "37"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_extensions:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0F22F7CB-24CC-445F-87D9-CB0B4346401E",
"versionEndExcluding": "14"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_framework:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7C2A16C-A840-47FF-9272-A17BD4CD7499",
"versionEndExcluding": "35"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_insights:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97643BD1-2CE5-43A4-86C9-C25EE643E977",
"versionEndExcluding": "32"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_ivr:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "58DA2A15-7F8A-4D04-A158-18CBB803BF8C",
"versionEndExcluding": "23"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_mdm:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A1287A97-8E7A-4B5F-BE14-2D871BD2E886",
"versionEndExcluding": "29"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_patch:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5CA0410D-FC23-4F02-B460-3AAF36534B35",
"versionEndExcluding": "54"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_patch_policies:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99FC5DA2-E98F-4EE7-ABC1-9CAE3141DE63",
"versionEndExcluding": "51"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_permissions_and_preferences:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14A1AC9F-42FA-4CEA-9198-78F902069EB5",
"versionEndExcluding": "27"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_profile_management:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EC90454-5ACF-437A-98E5-4FA331436BAB",
"versionEndExcluding": "33"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_query:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C9399A9A-9034-45E1-848A-96618F90AE9A",
"versionEndExcluding": "45"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_reports:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "76DCC419-4FDB-4863-847D-346BF4EC3458",
"versionEndExcluding": "24"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_scm:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5AF61FBA-D9FA-4D8F-9C63-BDB7266281E3",
"versionEndExcluding": "20"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_software_distribution:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78E47D3B-035E-4B5A-90FB-B15262EE93F0",
"versionEndExcluding": "54"
},
{
"criteria": "cpe:2.3:a:hcltech:bigfix_webui_take_action:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E08C0D1-A177-40F8-B5E0-EA14D66B38FC",
"versionEndExcluding": "37"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@hcl.com"
}