HCL BigFix Platform XSS Vulnerability Could Lead to Malicious Code Execution
CVE-2023-37529

5.4MEDIUM

Key Information:

Vendor
HCL Software
Status
BigFix Platform
Vendor
CVE Published:
29 February 2024

Summary

A cross-site scripting (XSS) vulnerability exists in the Web Reports component of HCL BigFix Platform, potentially allowing attackers to inject and execute malicious JavaScript code in a user's browser. This could lead to unauthorized access to cookie-stored information, posing significant security risks for affected users. Mitigation strategies must be employed to safeguard against possible exploitation of this vulnerability, ensuring the integrity of user data and the overall security posture of the platform.

Affected Version(s)

BigFix Platform 9.5 - 9.5.23, 10 - 10.0.10

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.