CVE-2024-23553: A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform
Published Feb 2, 2024
·Updated
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform exists due to missing a specific http header attribute.
Affected Software
3 affected components
hcltech Bigfix Platform>=9.5<9.5.24
hcltech Bigfix Platform>=10.0.0<10.0.11
hcltech Bigfix Platform=11.0.0
Event History
Feb 2, 2024
CVE Published
via MITRE·09:03 PM
Data Sourced
via MITRE·09:03 PM
DescriptionSeverity
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-23553?
CVE-2024-23553 is classified as a cross-site scripting (XSS) vulnerability in the HCL BigFix Platform.
2
How do I fix CVE-2024-23553?
To mitigate CVE-2024-23553, ensure that the missing HTTP header attribute is properly implemented in your Web Reports configuration.
3
What components are affected by CVE-2024-23553?
CVE-2024-23553 affects the Web Reports component of HCL BigFix Platform versions between 9.5.0 and 9.5.24, 10.0.0 and 10.0.11, as well as version 11.0.0.
4
Can CVE-2024-23553 be exploited remotely?
Yes, CVE-2024-23553 can be exploited remotely through a vulnerable Web Reports interface.
5
What are the potential impacts of CVE-2024-23553?
Exploiting CVE-2024-23553 may allow attackers to inject malicious scripts, leading to data theft or session hijacking.