The vulnerability is a misconfiguration of the Content Security Policy (CSP) header that allows attackers to inject malicious scripts into the web interface. This flaw exposes the application to classic cross‑site scripting attacks, which could let an adversary steal session tokens, read confidential data, or modify the user experience. The weakness is classified as CWE‑358, highlighting that the issue stems from improper configuration management rather than a coding bug.

The problem occurs in HCL BigFix Service Management (SM). No specific version range was supplied, so all installations of the product are potentially affected until the vendor releases a fix or configuration guidance.

The CVSS score of 3.7 indicates a low‑to‑moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is not explicitly stated, it is inferred to be a web‑based exploitation that requires an authenticated or unauthenticated user to access the service management console. Without a patched or properly configured CSP header, the risk remains that an attacker could execute arbitrary JavaScript in the context of legitimate users.