Medium severity · published Feb 3, 2024
CVE-2023-37528
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of…
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
A cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attack to exploit an application parameter during execution of the Save Report.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bigfix Platform · Hcltech
9.5 before 9.5.24; 10.0.0 before 10.0.11; 11.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37528
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37528
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209
More from Bigfix Platform
9.8
CVE-2021-27762
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
8.8
CVE-2024-23554
HCL BigFix Platform is susceptible to Cross-Site Request Forgery
8.8
CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request
8.1
CVE-2024-42193
HCL BigFix Web Reports is susceptible to a Man-In-The-Middle (MITM) attack
7.8
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys