CVE-2025-52621 HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning
Attackers can poison the cache of HCL BigFix SaaS by exploiting unvalidated Origin header reflection, potentially bypassing security controls or exposing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-52621?
CVE-2025-52621 is a medium-severity vulnerability in HCL Software BigFix SaaS Remediate, published on 15 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning. The BigFix SaaS's HTTP responses were observed to include the Origin header. Its presence alongside an unvalidated reflection of the Origin header value introduces a potential for cache poisoning.
Weakness: CWE-346
Which versions are affected by CVE-2025-52621?
It affects 1 product.
Products include Hcltech Bigfix Saas.
How do I fix CVE-2025-52621?
No fix has been published for CVE-2025-52621 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-52621 being exploited?
There is no known exploitation of CVE-2025-52621 in the wild and no public exploit code.
Other vulnerabilities in HCL Software BigFix SaaS Remediate
- CVE-2025-52619 HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure
- CVE-2025-52618 HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability
- CVE-2025-52620 HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-r9j3-884r-cxhp.