CVE-2025-31957

HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.

View on CVE.org
Published May 6, 2026 CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Description
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

Analysis

AI-generated

Technical impact

HCL BigFix Service Management is vulnerable to Cross‑Site Request Forgery. An attacker can cause a logged‑in user to perform privileged actions or expose sensitive data without the user’s knowledge. The vulnerability stems from missing CSRF protections on state‑changing operations (CWE‑352).

Affected Systems

The affected product is HCL Software BigFix Service Management (SM). No specific version information is listed, so all currently deployed instances should be treated as potentially vulnerable until confirmed otherwise.

Risk and Exploitability

The CVSS score of 2.6 indicates a relatively low severity, and the issue is not listed in CISA's KEV catalog. Exploitation requires a user with valid credentials to inadvertently submit a malicious request; an attacker can provoke this by sending the victim a link or embedding a crafted form. Successful exploitation can lead to unauthorized data modifications or disclosure limited to the victim’s permission scope.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor-defined patch or upgrade to the newest BigFix Service Management release that addresses the CSRF flaw.
  • If an immediate patch is not available, restrict or disable the endpoints that allow state‑changing operations vulnerable to CSRF.
  • Ensure that all state‑changing requests validate a unique anti‑CSRF token that is bound to the user’s session and that requests from untrusted origins are rejected.
  • Monitor application logs for unexpected state‑changing requests originating from untrusted sources to detect potential exploitation attempts.

Generated by OpenCVE AI on May 6, 2026 at 15:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Hcltech
Hcltech bigfix Service Management
CPEs cpe:2.3:a:hcltech:bigfix_service_management:23.0:*:*:*:*:*:*:*
Vendors & Products Hcltech
Hcltech bigfix Service Management
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
Title HCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability.
Weaknesses CWE-352
References
Metrics cvssV3_1

{'score': 2.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)

Sources

Status
PUBLISHED
Assigner
HCL
Published
Updated
May 6, 2026, 2:50 PM
Reserved
Apr 1, 2025, 6:46 PM

View source JSON

Updated
May 6, 2026, 2:50 PM

JSON

Status
Analyzed
Published
May 6, 2026, 3:16 PM
Modified
Oct 7, 2026, 9:10 AM

View source JSON

No data.

Updated
May 7, 2026, 8:30 PM

JSON