CVE-2025-31958

HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:bigfix_service_management:23.0:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) HCL BigFix Service Management es susceptible al Contrabando de Solicitudes HTTP. Las vulnerabilidades de contrabando de solicitudes HTTP surgen cuando los sitios web enrutan solicitudes HTTP a través de servidores web con análisis HTTP inconsistente. El Contrabando HTTP explota inconsistencias en el análisis de solicitudes entre servidores front-end y back-end, permitiendo a los atacantes eludir los controles de seguridad y realizar ataques como el envenenamiento de caché o el secuestro de solicitudes.

Information

Published : 2026-04-21 15:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-31958

Mitre link : CVE-2025-31958

CVE.ORG link : CVE-2025-31958

JSON object : View

Products Affected

hcltech

bigfix_service_management

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2025-31958", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31958", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T19:32:02.512507Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCLSoftware", "product": "BigFix Service Management (SM)", "versions": [{"status": "affected", "version": "23"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-21T15:16:35.440", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "HCL BigFix Service Management is susceptible to HTTP Request Smuggling.\u00a0 HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking."}, {"lang": "es", "value": "HCL BigFix Service Management es susceptible al Contrabando de Solicitudes HTTP. Las vulnerabilidades de contrabando de solicitudes HTTP surgen cuando los sitios web enrutan solicitudes HTTP a trav\u00e9s de servidores web con an\u00e1lisis HTTP inconsistente. El Contrabando HTTP explota inconsistencias en el an\u00e1lisis de solicitudes entre servidores front-end y back-end, permitiendo a los atacantes eludir los controles de seguridad y realizar ataques como el envenenamiento de cach\u00e9 o el secuestro de solicitudes."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_service_management:23.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D915AC1-7C2B-497D-9A77-9726954B2282"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}