HCL BigFix Service Management exposes two API endpoints that return sensitive data that should be protected. This leads to information disclosure, potentially giving an attacker details that could enable subsequent, more serious attacks. The weakness corresponds to CWE-200 and CWE-209. The compromised data reduces confidentiality and could be a stepping stone for further compromise.

The affected product is HCL BigFix Service Management from HCL Software. No specific version range is listed in the CNA data, so all deployments of this product are potentially impacted. Endpoints that expose sensitive data must be considered vulnerable.

The CVSS score of 5.3 indicates a moderate impact level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote exploitation via the exposed API endpoints, which could be accessed without authentication or with insufficient authorization controls. Attackers who succeed in obtaining the disclosed information can potentially leverage it for further attacks such as credential reuse, privilege escalation, or data exfiltration.