CVE-2025-31957

MediumCVSS 5.7/10Last modified Oct 7, 2026

Description

HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
May 6, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-319588.2HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTCVE-2025-319593.5HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and prCVE-2025-31965.5A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2CVE-2025-319605.3HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was CVE-2025-319614.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-319624.3Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gaiCVE-2025-319633.3Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attaCVE-2025-319644.9Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact sCVE-2025-319658.2Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthCVE-2025-319662.7HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforcedCVE-2025-319696.1HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and bCVE-2025-31977.3Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function e
CVE-2025-31957: Medium severity, CVSS 5.7 | Vulnix