Medium severity · published Feb 3, 2024
CVE-2023-37528
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of…
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bigfix Platform · Hcltech
9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37528
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37528
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
More from Bigfix Platform
9.8
CVE-2021-27762
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
8.8
CVE-2024-23554
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE)
8.8
CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request
8.1
CVE-2024-42193
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation
7.8
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys