Low severity · published Jan 23, 2025
CVE-2024-42185
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
2.5
CVSS
0.1%
EPSS
No
On KEV
Description
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
BigFix Patch Management Download Plug-ins · HCL Software
1177 and below · source: vendor
Affected product
BP
BigFix Patch Management Download Plug-ins
HCL Software
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42185
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42185
support.hcl-software.com
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565
More from BigFix Patch Management Download Plug-ins
5.3
CVE-2024-42187
HCL BigFix Patch Download Plug-ins are affected by path traversal vulnerability
2.8
CVE-2024-42186
HCL BigFix Patch Download Plug-ins are affected by an insecure protocol support
2.5
CVE-2024-42184
HCL BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme
2.5
CVE-2024-42183
HCL BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability
2.5
CVE-2024-42182
HCL BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability