HCL BigFix WebUI Missing Authorization Vulnerability Allowing Unauthorized Access to Sensitive Information

A missing authorization vulnerability exists in HCL BigFix WebUI, specifically in the Framework Application. This vulnerability allows an authenticated user without the necessary permissions to access sensitive environmental information by directly navigating to the unauthorized page via URL. The issue arises from unprotected endpoints that lack adequate security headers, enabling users to bypass privilege requirements and access internal data such as site names, versions, and configuration variables.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive environmental information, including internal data, site names, versions, and configuration variables.

Remediation

Users are advised to upgrade to HCL BigFix WebUI version 35 for the Framework Application. For other WebUI applications, please refer to the specific version details provided in the HCL BigFix WebUI Security Bulletin.