Summary
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Daten zu manipulieren, und um einen Denial of Service Angriff durchzuführen.
Product
BigFix ist eine Lösung zum Erkennen und Verwalten von physischen und virtuellen Endpunkten.
Vulnerabilities 3
-
Low 2.9
HCL BigFix IVR is impacted by improper authentication and missing CSRF protection
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
-
Low 2.2
HCL BigFix IVR is impacted by an improper service binding configuration
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local a…
-
Low 2.0
HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-1280, EUVD-2026-1264, EUVD-2026-1266
-
#1
Initiale Fassung
References
-
HCL Security Bulletin vom 2026-01-06
https://support.hcl-software.com/community?id=community_blog&sys_id=90bc10a9339abe94159a05273e5c7bd3
-
HCL Security Bulletin vom 2026-01-06
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753