High severity · published Aug 15, 2025
CVE-2025-52621
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
BigFix SaaS Remediate · HCL Software
< 8.1.14 · source: vendor
BS
Bigfix Saas · Hcltech
before 8.1.14 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52621
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52621
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123330
More from BigFix SaaS Remediate
9.8
CVE-2025-52618
HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability
5.4
CVE-2025-52622
HCL BigFix SaaS Remediate is affected by a security vulnerability
5.4
CVE-2025-52620
HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability
5.3
CVE-2025-52619
HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure