Lucene search

[email protected]CVE-2024-23540

HistoryApr 03, 2024 - 5:15 p.m.

CVE-2024-23540

2024-04-0317:15:50

[email protected]

web.nvd.nist.gov

cve-2024-23540

hcl bigfix inventory

path traversal

internal application files

inventory server

static file

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.9%

JSON

The HCL BigFix Inventory server is vulnerable to path traversal which enables an attacker to read internal application files from the Inventory server. The BigFix Inventory server does not properly restrict the served static file.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BigFix Inventory",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "9.x, 10.x"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112015

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

8.9%

JSON

Related for CVE-2024-23540

cvelist1 nvd1