HCL BigFix WebUI Improper Authorization Vulnerability Allowing Data Access and Privilege Bypass

A vulnerability in HCL BigFix WebUI exists that allows an authenticated user without Master Operator privileges to access internal data, such as site names, versions, and configuration variables. This is achieved by exploiting unprotected endpoints that lack adequate security headers, thereby bypassing privilege requirements.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive internal data and the ability to bypass established privilege requirements, potentially allowing users to perform actions or access information they should not be entitled to.

Remediation

Users are advised to upgrade to the latest version of HCL BigFix WebUI. Specific version recommendations can be found in the HCL BigFix WebUI Security Bulletin.