HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability. The image upload functionality inadequately validated the submitted image format. This could allow attackers to execute arbitrary scripts in the context of the user’s session.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 4.3 | CVE-2025-52620 |
Exploitation
To exploit this vulnerability, an attacker could craft a malicious image file that, when uploaded, executes JavaScript code in the context of the user’s session. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive information.
Affected Products
- HCL BigFix SaaS Authentication Service: Vulnerable due to improper validation of image formats during upload, allowing for potential XSS attacks.
Mitigation
To mitigate this vulnerability, it is recommended to implement proper validation and sanitization of uploaded files to ensure that only safe and expected formats are accepted. Additionally, applying security patches provided by HCL Software can help address this issue.