HCL BigFix Platform XSS Vulnerability
CVE-2023-37528

6.5MEDIUM

Key Information:

Vendor

Hcl Software
Status
Bigfix Platform
Vendor
CVE Published:
3 February 2024

What is CVE-2023-37528?

A cross-site scripting (XSS) vulnerability exists in the Web Reports component of HCL BigFix Platform, potentially enabling an attacker to exploit application parameters during the execution of the Save Report function. This flaw highlights the importance of securing web applications against injection attacks, as exploitation could lead to unauthorized access or manipulation of sensitive data. Organizations using the affected version of HCL BigFix are advised to take immediate action to mitigate the risks associated with this security vulnerability.

Affected Version(s)

BigFix Platform 9.5 - 9.5.23, 10 - 10.0.9

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.