CVE-2023-28012: medium-severity vulnerability in HCL BigFix Mobile
HCL BigFix Mobile can be affected by a command injection vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL BigFix Mobile allows an authenticated attacker to inject and execute arbitrary shell commands on the WebUI server, potentially compromising the system's integrity and confidentiality.
This command injection vulnerability in HCL BigFix Mobile's WebUI accepts unsanitized input from authenticated users, allowing execution of arbitrary shell commands with server privileges. The attack requires prior authentication and could lead to unauthorized code execution, data exfiltration, or lateral movement within the infrastructure.
In the same product, most dangerous first.