CVE-2023-37525 MEDIUM

CVE-2023-37525: HCL BigFix Compliance is vulnerable to a sensitive information disclosure

Vendor Hclsoftware
Product BigFix Compliance
Weakness CWE-497
Published January 28, 2026
Last update January 29, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.

Key dates

02Disclosure timeline

January 28, 2026 CVE published
January 29, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-48024 WordPress Keep Backup Daily plugin <= 2.1.3 - Sensitive Data Exposure vulnerability CVE-2025-13691 DataStage on Cloud Pak for Data is vulnerable to sensitive information leaks due to HTTP processing CVE-2021-23135 Argo CD leaked secret data into error messages and logs on invalid edits via UI CVE-2025-52719 WordPress ProfileGrid plugin <= 5.9.5.2 - Full Path Disclosure (FPD) Vulnerability CVE-2024-31887 IBM Security Verify Privilege information disclosure