Exposed hidden directories in HCL BigFix Service Management allow unauthorized users to retrieve files that were not meant to be publicly accessible. The vulnerability arises because the application does not restrict direct URL access to certain directories, leading to a confidentiality breach. An attacker who can guess or enumerate the directory paths could read configuration files, logs, or other sensitive data stored there, potentially aiding further compromise.

Systems running HCL Software's BigFix Service Management (SM) are affected. The scan was performed on the generic product without specific version information, so any deployment of the product should be examined. No particular version range was listed in the CNA data.

The CVSS score of 3.7 indicates a low‑to‑moderate risk. EPSS data is unavailable, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widespread exploitation is documented. The likely attack vector is remote HTTP access to non‑linked directories, which may require the attacker to discover the correct URL paths. No authentication is required if the directories are directly accessible; thus, the risk is primarily exposure of sensitive information to anyone who can reach the web server.