HCL BigFix Service Management (SM) suffers a security misconfiguration: the "X-Content-Type-Options" header is missing or set insecurely. Without this header, web browsers may perform MIME‑type sniffing, interpreting served content as a different type than declared. This flaw enables an attacker to deliver content that browsers will execute incorrectly, such as scripts masquerading as harmless data. The weakness falls under CWE‑200, indicating a lack of proper header configuration and the risk of unintended content processing.

The affected product is HCL BigFix Service Management (SM). No specific version information is available in the current data. The vulnerability applies to all deployments exposing the web interface of this product.

The CVSS score of 3.7 describes a moderate risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not a widely exploited or actively targeted flaw. The likely attack vector involves users’ browsers interacting with the web interface of BigFix SM, where a malicious actor can craft a request that returns content with an improper content‑type. Exploitation requires the victim’s browser to load this content; thus, it is a client‑side vulnerability reliant on the user’s environment. Given these conditions, the overall risk remains moderate but warrants timely remediation.