CVE-2025-52622

{"id": "CVE-2025-52622", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-52622", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-02T18:39:06.429198Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "BigFix SaaS Remediate", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-02T18:15:47.820", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127171", "source": "psirt@hcl.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks."}, {"lang": "es", "value": "Las respuestas HTTP de BigFix SaaS carec\u00edan de algunos encabezados de seguridad. La ausencia de estos encabezados debilita la postura de seguridad del lado del cliente de la aplicaci\u00f3n, haci\u00e9ndola m\u00e1s vulnerable a ataques web comunes que estos encabezados est\u00e1n dise\u00f1ados para mitigar, como Cross-Site Scripting (XSS), Clickjacking y ataques de degradaci\u00f3n de protocolo."}], "lastModified": "2026-10-18T18:10:00.100", "sourceIdentifier": "psirt@hcl.com"}