Low severity · published Nov 7, 2024
CVE-2024-30142
HCL BigFix Compliance is affected by a missing secure flag on a cookie
3.8
CVSS
0.1%
EPSS
No
On KEV
Description
HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
BigFix Compliance · HCL Software
2.0.11 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30142
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197
More from BigFix Compliance
6.5
CVE-2024-23551
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
6.2
CVE-2024-30125
HCL BigFix Compliance is affected by an internal server error
5.4
CVE-2024-30140
HCL BigFix Compliance is affected by unvalidated redirects and forwards
4.7
CVE-2024-30141
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information
4.7
CVE-2024-30126
HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability