CVEvulnerability

CVE-2023-37520

6.1 MEDIUM Published 2023-12-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.7 HIGH — CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

Affected configurations

• hcltech bigfix platform (>= 9.5 < 9.5.23) • hcltech bigfix platform (>= 10.0.0 < 10.0.10) • hcltech bigfix platform 11.0.0

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References