CVE-2024-23554
Assigner: HCL
Published: 2024-05-17T23:31:39.585Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: BigFix Platform
vendor: HCL Software
versions: status: affected
version: 9.5 - 9.5.24, 10 - 10.0.11, 11.0.1
datePublic: 2024-05-17T16:40:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <span style="background-color: rgb(255, 255, 255);">Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). </span><br>
value: Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). 

metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
version: 3.1
format: CVSS
scenarios: value: GENERAL 
problemTypes: descriptions: cweId: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
type: CWE
source: discovery: UNKNOWN
title: HCL BigFix Platform is susceptible to Cross-Site Request Forgery 
x_generator: engine: Vulnogram 0.1.0-dev