title: HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
description: Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.
affected:
{
defaultStatus: unaffected
product: HCL BigFix Platform
vendor: HCL Software
versions:
status: affected, version: 9.5.x, 10.0.x, 11.0.0
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL