CVE-2023-37520: HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-12-21 · updated 2026-06-17
Weakness: CWE-79

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

Affected products

HCL Software BigFix Platform: from 9.5 before 9.5.23; from 10.0.0 before 10.0.10; 11.0.0 — fixed in 10.0.10, 9.5.23

How to fix

Upgrade to a fixed version: HCL Software BigFix Platform 10.0.10, 9.5.23. Check the vendor advisory for mitigations.

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376

Get alerted when CVE-2023-37520 or the next vulnerability affects your stack