PT-2025-45111 · Hcl · Bigfix Query

Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-52602

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL BigFix Query (affected versions not specified)

Description HCL BigFix Query’s WebUI Query application is susceptible to sensitive information disclosure. An HTTP GET request to an endpoint can reveal discoverable responses, potentially exposing group names and active user names or IDs. This information could be leveraged by attackers to target individuals with phishing or other social-engineering attacks. The /api/v1/query API endpoint is involved in this issue. The user id and group name variables are potentially exposed through this vulnerability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2025-52602

Affected Products

Bigfix Query

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-52602 · Security Note
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124950 · Note
• https://t.me/CVEtracker/36619 · Telegram Post