Skip to content
OpenAdvisories
Medium WID-SEC-2023-3204 2 CVEs

HCL BigFix: Schwachstelle ermöglicht Cross-Site Scripting

Published Dec 21, 2023 · Updated Dec 21, 2023 · de-DE

Vendor: HCL Software Product: BigFix Product: BigFix < 10.0.10 Product: BigFix < 11.0.1 Product: BigFix < 9.5.23 Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 2

  • High 7.7
    CVE-2023-37519

    HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

    Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status Report, which is served by the BigFix Server. 

    HCL Software HCL BigFix Platform
  • High 7.7
    CVE-2023-37520

    HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

    Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

    HCL Software HCL BigFix Platform

Revision history

  1. #1

    Initiale Fassung

References