CVE-2025-52602: hcl software bigfix query

Vulnerability summary

CVE-2025-52602 is a medium (CVSS 4.2) vulnerability in hcl software bigfix query. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 5.4% of scored vulnerabilities.

Timeline

1. 05-11-2025
   PublishedVulnerability first disclosed.
2. 12-11-2025
   Last modifiedVulnerability information updated.

Description

HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.  An HTTP GET endpoint request returns discoverable responses that may disclose: group names, active user names (or IDs).  An attacker can use that information to target individuals with phishing or other social-engineering attacks.

• CWE-359Exposure of Private Personal Information to an Unauthorized ActorThe product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.