CVE-2023-37527

{"id": "CVE-2023-37527", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-02T19:15:07.990", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0110209", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected cross-site scripting (XSS) vulnerability in the Web Reports component of HCL BigFix Platform can possibly allow an attacker to execute malicious javascript code in the application session or in database, via remote injection, while rendering content in a web page. \n"}, {"lang": "es", "value": "Una vulnerabilidad de Cross-Site Scripting (XSS) Reflejado en el componente Web Reports de HCL BigFix Platform posiblemente pueda permitir que un atacante ejecute c\u00f3digo javascript malicioso en la sesi\u00f3n de la aplicaci\u00f3n o en la base de datos, mediante inyecci\u00f3n remota, mientras representa contenido en una p\u00e1gina web."}], "lastModified": "2025-06-03T19:15:32.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8477E2A-0466-4415-9420-9D1183AF9FA3", "versionEndExcluding": "9.5.24", "versionStartIncluding": "9.5"}, {"criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35E5DFF7-4361-4A0C-A028-38FBF2A779F7", "versionEndExcluding": "10.0.11", "versionStartIncluding": "10.0.0"}, {"criteria": "cpe:2.3:a:hcltech:bigfix_platform:11.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C54B20CA-80AF-4E7E-A511-C208E81FB37E"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}