CVE-2022-27545CWE-79cross-site-scripting

CVE-2022-27545

Medium · published July 19, 2022

CVSS v3.1
4.6
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00336 · 25.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-07-19T20:15Z
Affected products (2)
ProductVersionsFixed in
hcltech/bigfix_platform≥ 9.5, ≤ 9.5.19—
hcltech/bigfix_platform≥ 10.0, ≤ 10.0.6—
References (2)
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998 · [email protected]https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098998 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 19 JUL 15:40Z
    HCL BigFix Web Reports authorized users may perform HTML injection.
    cvelistv5