LOW🇵🇱 Wersja polska

CVE-2025-31962

CVSS 2.0v3.1pub. 2026-01-07upd. 2026-01-12

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

  • Hcltech Bigfix Insights For Vulnerability Remediation

    APP
    Hcltech
    4.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-44757MEDIUM6.5same product

BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposur...

CVE-2022-44758MEDIUM6.5same product

BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can g...

CVE-2025-31963LOW2.9same product

Nieprawidłowa autentykacja i brak ochrony CSRF w komponentcie lokalnego interfejsu konfiguracyjnego HCL BigFix...

CVE-2025-31964LOW2.2same product

Nieprawidłowa konfiguracja wiązania usług w wewnętrznych komponentach HCL BigFix IVR w wersji 4.2 umożliwia up...

CVE-2025-62319CRITICAL9.8PL ✓same vendor

Boolean-Based SQL Injection umożliwiający wstrzyknięcie dowolnego SQL