CVE-2023-37520

HIGH

7.7

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

CVE Details

CVSS v3.1 Score7.7

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityHIGH

Privileges RequiredNONE

User InteractionREQUIRED

Published12/21/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

hcltech:bigfix_platform

Weaknesses (CWE)

CWE-79

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376(psirt@hcl.com)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.