HCL BigFix Service Management Security Misconfiguration Vulnerability Allowing MIME-Type Sniffing

A security misconfiguration vulnerability has been identified in HCL BigFix Service Management (SM) version 23. The issue arises from a missing or insecure 'X-Content-Type-Options' header, which could enable browsers to perform MIME-type sniffing. This misconfiguration may lead to malicious content being incorrectly interpreted and executed.

Impact

The vulnerability could allow for improper handling of content types, potentially leading to the execution of malicious files or scripts.

Remediation

Users can upgrade to HCL BigFix Service Management (SM) version 27 to address this vulnerability.