CVE-2025-52621
BaseFortify
Publication date: 2025-08-15
Last updated on: 2025-10-29
Assigner: HCL Software
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcltech | bigfix_saas | to 8.1.14 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in HCL BigFix SaaS Authentication Service is a cache poisoning issue caused by the HTTP responses including the Origin header. Because the Origin header value is reflected without validation, it allows an attacker to manipulate cached responses, potentially causing users to receive malicious or incorrect data.
How can this vulnerability impact me? :
The vulnerability can lead to cache poisoning, which may cause users to receive manipulated or malicious content from the cache. This can result in exposure to incorrect information or potential security risks, although the impact is limited to confidentiality with no direct impact on integrity or availability.