CVE-2025-52647 MEDIUM

CVE-2025-52647: HCL BigFix WebUI is affected by a host header poisoning vulnerability

Vendor Hcl Software
Product BigFix WebUI
Weakness CWE-644
Published October 10, 2025
Last update October 14, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The BigFix WebUI application responds with HOST information from the HTTP header field making it vulnerable to Host Header Poisoning Attacks.

Key dates

02Disclosure timeline

October 10, 2025 CVE published
October 14, 2025 Record updated