PT-2024-23210 · Hcl · Hcl Bigfix Compliance

Published 2024-11-07 · Updated 2024-11-08 · CVE-2024-30140

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions HCL BigFix Compliance versions prior to 2.0.11

Description The issue affects HCL BigFix Compliance due to unvalidated redirects and forwards. An attacker can manipulate the HOST header, resulting in web cache poisoning, which can serve malicious content to users. This can lead to unauthorized access and exposure of sensitive data.

Recommendations For versions prior to 2.0.11, patch immediately to prevent unauthorized access and protect sensitive data. As a temporary workaround, consider restricting access to the web cache to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-30140

Affected Products

Hcl Bigfix Compliance

References · 7

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-30140 · Security Note
• https://osv.dev/vulnerability/CVE-2024-30140 · Vendor Advisory
• https://t.me/cvenotify/100893 · Telegram Post
• https://twitter.com/CVEnew/status/1854444620362502588 · Twitter Post
• https://t.me/cvedetector/10059 · Telegram Post
• https://twitter.com/oktsec/status/1854473262316540008 · Twitter Post