HCL BigFix Platform XSS Vulnerability Could Lead to Malicious Code Execution
CVE-2023-37529

5.4MEDIUM

Key Information:

Vendor

HCL Software Software

Status
Bigfix Platform
Vendor
CVE Published:
29 February 2024

What is CVE-2023-37529?

A cross-site scripting (XSS) vulnerability exists in the Web Reports component of HCL BigFix Platform, potentially allowing attackers to inject and execute malicious JavaScript code in a user's browser. This could lead to unauthorized access to cookie-stored information, posing significant security risks for affected users. Mitigation strategies must be employed to safeguard against possible exploitation of this vulnerability, ensuring the integrity of user data and the overall security posture of the platform.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

BigFix Platform 9.5 - 9.5.23, 10 - 10.0.10

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.