CVE-2025-59849CWE-1021CWE-693

CVE-2025-59849

Medium · published December 18, 2025

CVSS v3.1
4.7
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00192 · 8.4th percentile
Weaknesses
CWE-1021 · Improper Restriction of Rendered UI Layers or Frames; CWE-693 · Protection Mechanism Failure
Published
2025-12-18T02:16Z
Affected products (3)
ProductVersionsFixed in
hcltechsw/hcl_devops_deploy≥ 8.0.0.0, < 8.0.1.118.0.1.11
hcltechsw/hcl_devops_deploy≥ 8.1.0, < 8.1.2.48.1.2.4
hcltechsw/hcl_launch≥ 7.3.0.0, < 7.3.2.167.3.2.16
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332 · [email protected]
EPSS history
Timeline
  • 17 DEC 20:28Z
    HCL BigFix Remote Control is vulnerable to an insecure CSP configuration
    cvelistv5