Lucene search

K
vulnrichmentHCLVULNRICHMENT:CVE-2024-23554
HistoryMay 17, 2024 - 11:31 p.m.

CVE-2024-23554 HCL BigFix Platform is susceptible to Cross-Site Request Forgery

2024-05-1723:31:39
CWE-352
HCL
github.com
6
cve-2024-23554
hcl bigfix platform
cross-site request forgery
session token
remote code execution
vulnerability

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0

Percentile

9.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:hcltech:bigfix_platform:9.5:*:*:*:*:*:*:*"
    ],
    "vendor": "hcltech",
    "product": "bigfix_platform",
    "versions": [
      {
        "status": "affected",
        "version": "9.5",
        "versionType": "custom",
        "lessThanOrEqual": "9.5.24"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:hcltech:bigfix_platform:10.0.0:*:*:*:*:*:*:*"
    ],
    "vendor": "hcltech",
    "product": "bigfix_platform",
    "versions": [
      {
        "status": "affected",
        "version": "10.0.0",
        "versionType": "custom",
        "lessThanOrEqual": "10.0.11"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:hcltech:bigfix_platform:11.0.1:*:*:*:*:*:*:*"
    ],
    "vendor": "hcltech",
    "product": "bigfix_platform",
    "versions": [
      {
        "status": "affected",
        "version": "11.0.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

5.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

AI Score

7.7

Confidence

High

EPSS

0

Percentile

9.0%

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2024-23554