PT-2025-2631 · Ibm · Bigfix Patch Download Plug-Ins

Published 2025-01-23 · Updated 2025-01-23 · CVE-2024-42184

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

The BigFix Patch Download Plug-ins are affected by insecure support for the file URI scheme, which could allow a malicious operator to attempt to download files using the file:// URI scheme. This issue is related to the handling of URI schemes in the plug-ins. An exploit could be used to take advantage of this issue. The affected software is BigFix Patch Download Plug-ins, but the specific versions are not mentioned. More information about this issue can be found at the provided links, including https://t.co/DH8AVmf9LW and https://t.co/xhLrNnfyrO. #BigFix #PatchDownloadPlugins #InsecureURIScheme #FileURIScheme #LowSeverity #Exploit

Fix

Weakness Enumeration

CWE-84

Related Identifiers

CVE-2024-42184

Affected Products

Bigfix Patch Download Plug-Ins

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-42184 · Security Note
• https://t.me/cvedetector/16158 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1882274337949941972 · Twitter Post
• https://twitter.com/CVEnew/status/1882300175768539616 · Twitter Post
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565 · Note
• https://t.me/cvenotify/108322 · Telegram Post
• https://twitter.com/CVETracker/status/1882518934840016940 · Twitter Post