CVE-2025-31983 describes a vulnerability in HCL BigFix Service Management (SM) version 23 caused by a misconfigured Content Security Policy (CSP) header. This improper security check can enable attackers to inject malicious scripts, potentially leading to cross-site scripting (XSS) attacks and limited information disclosure. The vulnerability is categorized under CWE-358, which involves improperly implemented security checks. The CVSS 3.1 base score is 3.7, reflecting low severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. No vendor advisory or patch information is provided, and the product is not a cloud service, so remediation responsibility lies with the user.

The vulnerability could allow an attacker to inject malicious scripts due to a misconfigured CSP header, increasing the risk of cross-site scripting (XSS) attacks. This may lead to limited exposure of sensitive information and minor availability impact. The CVSS score of 3.7 indicates low severity, with no known exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor HCL communications for updates. Until a patch is available, consider reviewing and tightening CSP header configurations manually to reduce the risk of script injection.