PT-2025-2632 · Ibm · Bigfix Patch Download Plug-Ins

Published 2025-01-23 · Updated 2025-01-23 · CVE-2024-42185

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions BigFix Patch Download Plug-ins (affected versions not specified)

Description The issue is related to an insecure package in BigFix Patch Download Plug-ins that is susceptible to XML injection attacks. This allows an attacker to inject malicious XML content, which can lead to various issues including denial of service and unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2024-42185

Affected Products

Bigfix Patch Download Plug-Ins

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-42185 · Security Note
• https://twitter.com/CVEnew/status/1882300174900351202 · Twitter Post
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118565 · Note
• https://twitter.com/VulmonFeeds/status/1882279459056693588 · Twitter Post
• https://t.me/cvedetector/16159 · Telegram Post
• https://t.me/cvenotify/108323 · Telegram Post