PT-2020-10937 · Bigfix · Bigfix Self-Service Application

Published 2020-02-28 · Updated 2020-08-24 · CVE-2019-4301

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BigFix Self-Service Application (SSA) (affected versions not specified)

Description The issue allows for arbitrary code execution if Javascript code is included in Running Message or Post Message HTML.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2019-4301

Affected Products

Bigfix Self-Service Application

References · 4

• https://osv.dev/vulnerability/CVE-2019-4301 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4301 · Security Note
• https://t.me/cvenotify/1299 · Telegram Post
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0076139 · Note