CVE-2023-37527 — Cross-site Scripting in Bigfix Platform

CWE-79 — Cross-site Scripting3 documents3 sources
Severity
6.1MEDIUMNVD
CNA5.4
EPSS
0.1%
top 69.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Hcltech Bigfix PlatformHCL Software Bigfix Platform
Timeline
PublishedFeb 2

Description

A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDhcltech/bigfix_platform9.5 — 9.5.24+2
▶CVEListV5hcl_software/bigfix_platform9.5 - 9.5.23, 10 - 10.0.10

🔴Vulnerability Details

2
CVEList
A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform↗2024-02-02
▶
GHSA
GHSA-v4cg-mf2j-mwp7: A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute mal↗2024-02-02
▶
CVE-2023-37527 — Cross-site Scripting | cvebase