description: This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: HCL BigFix Inventory
vendor: HCL Software
versions:
status: affected, version: 9.x
status: affected, version: 10.x
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
availabilityRequirement: LOW
baseScore: 2.3
baseSeverity: LOW
confidentialityImpact: LOW
confidentialityRequirement: LOW
environmentalScore: 1.6
environmentalSeverity: LOW
exploitCodeMaturity: FUNCTIONAL
integrityImpact: NONE
integrityRequirement: LOW
modifiedAttackComplexity: HIGH
modifiedAttackVector: ADJACENT_NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: NONE
modifiedPrivilegesRequired: LOW
modifiedScope: UNCHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: UNAVAILABLE
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.3
temporalSeverity: LOW
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:H/MPR:L/MUI:R/MS:U/MC:X/MI:N/MA:N
version: 3.1
]