VulnerabilityModified

CVE-2023-37520

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration.

MEDIUM 6.1EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% probability · 17th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: hcltech/bigfix platform
Source: psirt@hcl.com

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.