HCL BigFix Service Management introduces an information exposure flaw in its reporting module. Supplying a consumer_company value that is invalid or out of range triggers an unhandled error, leaking sensitive details about the requested report. This flaw aligns with CWE‑209, where improper exception handling reveals confidential data.

The vulnerability affects HCL BigFix Service Management (SM). Specific versions or build numbers are not detailed in the available data, so any deployment of the product could potentially be impacted until a fix is applied.

The CVSS score of 5.3 places this issue in the medium‑risk zone, while the EPSS score is unreported and the vulnerability is not listed in the CISA KEV catalogue. This flaw allows an attacker to send crafted requests to the reporting endpoint, causing an unhandled exception that exposes information. The likely attack vector is remote via HTTP requests, based on the use of request parameters—but this is inferred from the description and not explicitly confirmed.