Medium severity · published Feb 2, 2024
CVE-2023-37527
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the…
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bigfix Platform · Hcltech
9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37527
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37527
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
More from Bigfix Platform
9.8
CVE-2021-27762
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
8.8
CVE-2024-23554
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE)
8.8
CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request
8.1
CVE-2024-42193
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation
7.8
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys