Lucene search

HCLCVELIST:CVE-2023-37536

HistoryOct 11, 2023 - 6:46 a.m.

CVE-2023-37536 HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

2023-10-1106:46:01

HCL

www.cve.org

hcl bigfix

platform

integer overflow

xerces-c++

remote attackers

http request

out-of-bound access

8.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H

8.9 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.0%

JSON

An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BigFix Platform",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "9.5 - 9.5.22, 10 - 10.0.9"
      }
    ]
  }
]

References

lists.debian.org/debian-lts-announce/2023/12/msg00027.html

lists.fedoraproject.org/archives/list/[email protected]/message/7A6WWL4SWKAVYK6VK5YN7KZP4MZWC7IY/

lists.fedoraproject.org/archives/list/[email protected]/message/AJYZUBGPVWJ7LEHRCMB5XVADQBNGURXD/

lists.fedoraproject.org/archives/list/[email protected]/message/DAOSSJ72CUJ535VRWTCVQKUYT2LYR3OM/

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0107791