HCL BigFix Query Sensitive Information Disclosure Vulnerability

A sensitive information disclosure vulnerability has been identified in the WebUI Query application of HCL BigFix Query, affecting all versions prior to 4.11.0. This vulnerability arises from an HTTP GET endpoint that returns responses disclosing group names and active user names or IDs. An attacker could exploit this information to target individuals with phishing or other social-engineering attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, allowing attackers to conduct targeted phishing or social-engineering attacks.

Remediation

Users can upgrade to HCL BigFix WebUI Query version 4.11.0 to address this vulnerability. After upgrading, gathering of the WebUI Query site will automatically apply the new content.