High WID-SEC-2022-2366 6 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Apr 24, 2022 · Updated Dec 19, 2022 · Revision 2 · de-DE

Vendor: HCL Software Product: BigFix Product: Domino Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Informationen offenzulegen eine URL Redirection durchzuführen oder Code auszuführen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 6

Critical 9.8

CVE-2021-44906 Public exploit

Prototype Pollution in minimist

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

js-jquery minimist node-minimist node-minimist Debian Ubuntu Azure Linux npm

Mar 17, 2022
High 8.8

CVE-2022-0235

Exposure of Sensitive Information to an Unauthorized Actor in node-fetch/node-fetch

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

node-fetch node-fetch/node-fetch node-fetch node-fetch Debian Ubuntu npm

Jan 16, 2022
High 8.8

CVE-2022-0355

Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get

Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.

feross feross/simple-get simple-get npm

Jan 26, 2022
High 8.0

CVE-2022-0155 Public exploit

Exposure of Private Personal Information to an Unauthorized Actor in follow-redirects/follow-redirects

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

follow-redirects follow-redirects/follow-redirects js-jquery follow-redirects Debian Ubuntu Azure Linux npm

Jan 10, 2022
High 7.4

CVE-2021-27764

HCL BigFix WebUI Cookie missing attributes

Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)

HCL Software HCL BigFix WebUI

May 6, 2022
Medium 5.3

CVE-2022-0122

Open Redirect in digitalbazaar/forge

forge is vulnerable to URL Redirection to Untrusted Site

Digital Bazaar digitalbazaar/forge node-forge npm

Jan 6, 2022

Revision history

2022-12-19 #2
Neue Updates von HCL aufgenommen
2022-04-24 #1
Initiale Fassung

References

HCL Article KB0102172 vom 2022-12-19
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102172
HCL Security Bulletin vom 2022-04-24
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097778