HCL BigFix Platform XSS Vulnerability
CVE-2023-37528

6.1MEDIUM

Key Information:

Vendor

HCL Software Software

Status
Bigfix Platform
Vendor
CVE Published:
3 February 2024

What is CVE-2023-37528?

A cross-site scripting (XSS) vulnerability exists in the Web Reports component of HCL BigFix Platform, potentially enabling an attacker to exploit application parameters during the execution of the Save Report function. This flaw highlights the importance of securing web applications against injection attacks, as exploitation could lead to unauthorized access or manipulation of sensitive data. Organizations using the affected version of HCL BigFix are advised to take immediate action to mitigate the risks associated with this security vulnerability.

Affected Version(s)

BigFix Platform 9.5 - 9.5.23, 10 - 10.0.9

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.