PT-2023-21484 · Ibm · Bigfix Webui Api App

Published 2023-07-18 · Updated 2023-07-27 · CVE-2023-28019

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Bigfix WebUI API App versions prior to 14

Description The issue is related to insufficient validation, allowing an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.

Recommendations For versions prior to 14, update to version 14 or later to resolve the issue. As a temporary workaround, consider restricting access to the WebUI API to minimize the risk of exploitation. Avoid using unparameterized SQL queries in the affected API until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2023-28019

Affected Products

Bigfix Webui Api App

References · 4

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0106123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28019 · Security Note
• https://osv.dev/vulnerability/CVE-2023-28019 · Vendor Advisory
• https://t.me/cibsecurity/66944 · Telegram Post