CVE-2025-52622

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1188

Affected software

Vendor	Product	Versions
HCL Software	BigFix SaaS Remediate	0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127171

Timeline

Published: Dec 2, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-526236.5HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on passwo CVE-2025-526246.1A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may al CVE-2025-526257.5A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system ide CVE-2025-526269.8A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthori CVE-2025-526277.5Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, pot CVE-2025-526288.8HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-sit CVE-2025-526296.1HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting a CVE-2025-52634.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vuln CVE-2025-526307.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526318.1HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connection CVE-2025-526327.5A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526335.3HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in p