Skip to content
OpenAdvisories
Medium WID-SEC-2025-0151 7 CVEs

HCL BigFix: Mehrere Schwachstellen

Published Jan 21, 2025 · Updated Jan 21, 2025 · de-DE

Vendor: HCL Software Product: BigFix Platform: Windows

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, , um Daten zu manipulieren, vertrauliche Informationen preiszugeben, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu erzeugen.

Product

BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.

Vulnerabilities 7

  • Medium 5.6
    CVE-2024-35195

    Requests `Session` object does not verify requests after making first request with verify=False

    Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification r…

    psf requests katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • Medium 5.3
    CVE-2024-42187

    HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability

    BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a local repository which is vulnerable to path traversal attacks.

    HCL Software BigFix Patch Management Download Plug-ins
  • Low 2.8
    CVE-2024-42186

    HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support

    BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificates validation.

    HCL Software BigFix Patch Management Download Plug-ins
  • Low 2.5
    CVE-2024-42182

    HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability

    BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the application to download files from an internally hosted server on localhost.

    HCL Software BigFix Patch Management Download Plug-ins
  • Low 2.5
    CVE-2024-42183

    HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability

    BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious operator to download files from arbitrary URLs without any proper validation or allowlist controls.

    HCL Software BigFix Patch Management Download Plug-ins
  • Low 2.5
    CVE-2024-42184

    HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme

    BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.

    HCL Software BigFix Patch Management Download Plug-ins
  • Low 2.5
    CVE-2024-42185

    HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks

    BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of se…

    HCL Software BigFix Patch Management Download Plug-ins

Revision history

  1. #1

    Initiale Fassung

References