PT-2023-21482 · Hcl · Hcl Bigfix Osd Bare Metal Server

Published 2023-06-22 · Updated 2023-07-03 · CVE-2023-28016

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL BigFix OSD Bare Metal Server versions 311.12 or lower

Description The issue allows an attacker to supply invalid input, causing the server to perform a redirect to an attacker-controlled domain. This is achieved through a Host Header Injection.

Recommendations For HCL BigFix OSD Bare Metal Server versions 311.12 or lower, update to a version higher than 311.12 to resolve the issue. As a temporary workaround, consider restricting access to the server to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2023-28016

Affected Products

Hcl Bigfix Osd Bare Metal Server

References · 5

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28016 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28016 · Vendor Advisory
• https://t.me/cvenotify/52907 · Telegram Post
• https://t.me/cvenotify/53578 · Telegram Post