HCL BigFix Service Management version 27 is affected by a CORS misconfiguration vulnerability classified as CWE-942. The application improperly validates origin headers in CORS requests, which could allow an attacker to craft a malicious web page that interacts with the vulnerable application. This interaction could enable unauthorized access to protected resources and restricted APIs by leveraging the victim's authenticated session. The CVSS v3.1 base score is 3.1, reflecting a low-severity issue with network attack vector, high attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

The vulnerability allows an attacker to perform unauthorized interactions with protected resources or restricted APIs on behalf of a victim user through a malicious web page. There is no impact on confidentiality or availability. The low CVSS score and requirement for user interaction indicate limited risk and impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently provided. Until a patch is available, users should be cautious about untrusted web content and consider restricting CORS policies manually if possible.