HCL BigFix Service Management Information Exposure Vulnerability in Reporting Module

An information exposure vulnerability has been identified in HCL BigFix Service Management (SM) version 23. The issue arises from improper error handling in the reporting module, where supplying an invalid or out-of-range value to the consumer_company parameter during a report-viewing request triggers an unhandled exception. This flaw could potentially be exploited to access sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure by causing the application to reveal details through unhandled exceptions.

Remediation

Users can upgrade to HCL BigFix Service Management (SM) version 27 to address this vulnerability.