CVE-2025-0276: HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0276?
CVE-2025-0276 is classified as a high severity vulnerability due to its potential to allow unauthorized actions through insecure Content Security Policy directives.
How do I fix CVE-2025-0276?
To fix CVE-2025-0276, upgrade to HCL BigFix Modern Client Management version 3.4 or later, which addresses the insecure CSP directive issue.
What software is affected by CVE-2025-0276?
CVE-2025-0276 affects HCL BigFix Modern Client Management versions 3.3 and earlier.
How can an attacker exploit CVE-2025-0276?
An attacker can exploit CVE-2025-0276 by tricking users into executing malicious scripts due to the lack of proper restrictions in the Content Security Policy.
What is the main risk associated with CVE-2025-0276?
The main risk associated with CVE-2025-0276 is that it could lead to unauthorized access or actions due to improper handling of content sources.