CVE-2025-0277

HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)

State: Published
Severity: 6.5 Medium
Published: Oct 16, 2025
Updated: Oct 16, 2025
Reserved: Jan 6, 2025

Description

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L	HCL

Weaknesses

CWE-693 Protection Mechanism Failure
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Affected Products

Product	Versions
BigFix MobileHCL Software	<=3.3Affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.