Vulnerability · Published Nov 5, 2025 · Assigned by HCL
CVE-2025-52602HCL BigFix Query is affected by a sensitive information disclosure vulnerability in the WebUI Query application
Medium 4.2
In plain English
A medium-severity security flaw in BigFix Query from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.2%top 94.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs). An attacker can use that information to target individuals with phishing or other social-engineering attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | BigFix Query | site version < 43 |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N