CVE-2025-52621

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning.  The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-346

Affected software

No affected versions have been published.

Timeline

Published
Aug 15, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-526225.4The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side secuCVE-2025-526236.5HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on passwoCVE-2025-526246.1A vulnerability  Bypass of the script allowlist configuration in HCL AION.  An incorrectly configured Content-Security-Policy header may alCVE-2025-526257.5A vulnerability  Cacheable SSL Page Found vulnerability has been identified in HCL AION.  Cached data may expose credentials, system ideCVE-2025-526269.8A Potential Command Injection vulnerability in HCL AION.  An This can allow unintended command execution, potentially leading to unauthoriCVE-2025-526277.5Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, potCVE-2025-526288.8HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-sitCVE-2025-526296.1HCL AION is susceptible to Missing Content-Security-Policy.  An The absence of a CSP header may increase the risk of cross-site scripting aCVE-2025-52634.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnCVE-2025-526307.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526318.1HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connectionCVE-2025-526327.5A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.