Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

BigFix SaaS Missing Security Headers Exposes Clients to Web Attacks

CVE-2025-52622 · published 11 months ago
Summary

BigFix SaaS is missing important security features in its web responses, making it easier for hackers to launch common web attacks on users. This could allow attackers to inject malicious code, trick users into revealing sensitive information, or hijack user interactions. To protect your users, upgrade to the latest version of BigFix SaaS or apply the necessary security patches.

Original advisory text
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web att...
The BigFix SaaS's HTTP responses were missing some security headers. The absence of these headers weakens the application's client-side security posture, making it more vulnerable to common web attacks that these headers are designed to mitigate, such as Cross-Site Scripting (XSS), Clickjacking, and protocol downgrade attacks.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1188Initialization of a Resource with an Insecure Default
Timeline
Published2 Dec 2025
Updated2 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-52622 · NVD
Track software like this
Free during beta