How severe is CVE-2023-37525?

CVE-2023-37525 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2023-37525 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-37525?

CVE-2023-37525 affects Hcltech Bigfix Compliance. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-37525?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2023-37525 have an EU (EUVD) identifier?

Yes. CVE-2023-37525 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-41412.

When was CVE-2023-37525 published?

CVE-2023-37525 was published on 2026-01-28 and last updated on 2026-06-17.

CVE-2023-37525

CVE-2023-37525 is a medium-severity vulnerability in Hcltech Bigfix Compliance with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-497.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (21st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2023-41412
Weakness: CWE-497
Affected product: Hcltech Bigfix Compliance
Published: 2026-01-28
Last modified: 2026-06-17

Description

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.

Frequently asked questions

What is CVE-2023-37525?: A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals.
How severe is CVE-2023-37525?: CVE-2023-37525 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2023-37525 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-37525?: CVE-2023-37525 affects Hcltech Bigfix Compliance. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-37525?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2023-37525 have an EU (EUVD) identifier?: Yes. CVE-2023-37525 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-41412.
When was CVE-2023-37525 published?: CVE-2023-37525 was published on 2026-01-28 and last updated on 2026-06-17.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128385

Affected products (1)

cpe:2.3:a:hcltech:bigfix_compliance:2.0.9:*:*:*:*:*:*:*

More vulnerabilities in Hcltech Bigfix Compliance

CVE-2021-27756 — High (CVSS 7.5): "TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not…
CVE-2024-30125 — Medium (CVSS 6.2): HCL BigFix Compliance server can respond with an HTTP status of 500, indicating a server-side error that may cause the…
CVE-2024-42212 — Medium (CVSS 5.4): HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request…
CVE-2024-30140 — Medium (CVSS 5.4): HCL BigFix Compliance is affected by unvalidated redirects and forwards. The HOST header can be manipulated by an…
CVE-2024-42213 — Medium (CVSS 5.3): HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker…
CVE-2024-30141 — Medium (CVSS 4.7): HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed…

All CVEs affecting Hcltech Bigfix Compliance →

Other CWE-497 vulnerabilities

CVE-2025-10264 — Critical (CVSS 10.0): Certain models of NVR developed by Digiever has an Exposure of Sensitive Information vulnerability, allowing…
CVE-2026-27494 — Critical (CVSS 9.9): n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated…
CVE-2025-47699 — Critical (CVSS 9.9): Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho…
CVE-2025-44823 — Critical (CVSS 9.9): Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a…
CVE-2026-14808 — Critical (CVSS 9.8): Prog Management System developed by PROG MIS has a Exposure of Sensitive Information vulnerability, allowing…
CVE-2024-13999 — Critical (CVSS 9.8): Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose the server's Active Directory (AD) or…

Browse all CWE-497 vulnerabilities →