CVE-2023-37520: HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
First published: Thu Dec 21 2023(Updated: )
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
Credit: psirt@hcl.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hcltech Bigfix Platform | >=9.5<9.5.23 | |
| Hcltech Bigfix Platform | >=10.0.0<10.0.10 | |
| Hcltech Bigfix Platform | =11.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/author
- agent/title
- agent/weakness
- agent/references
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- vendor/hcltech
- canonical/hcltech bigfix platform
- version/hcltech bigfix platform/9.5
- version/hcltech bigfix platform/10.0.0
- version/hcltech bigfix platform/11.0.0