CVE-2023-37536highCWE-680

CVE-2023-37536: high-severity vulnerability in HCL Software BigFix Platform

HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3

Published · Updated

Follow this CVE+ Monitor BigFix Platform+ Monitor xerces-c

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 1.9%
In short

HCL BigFix Platform contains a vulnerability in its XML processing library (xerces-c++) that allows remote attackers to send specially crafted HTTP requests, causing the software to access memory outside safe boundaries and potentially crash or leak data.

Technical detail

An integer overflow vulnerability in xerces-c++ 3.2.3 used by BigFix Platform enables remote attackers to trigger out-of-bounds memory access through malformed HTTP requests without authentication. The vulnerability affects XML parsing operations and can result in denial of service or information disclosure.

Summary generated and translated by AI from the official description.
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Affected products
HCL Software · BigFix Platform
Related CVEs — HCL Software BigFix Platform

In the same product, most dangerous first.

CVE-2021-27762MEDIUMHCL BigFix Platform is affected by misconfigured security-related HTTP headersEPSS 0.7%CVE-2023-45715LOWHCL BigFix Platform is susceptible to a Denial of Service attackEPSS 0.4%CVE-2024-23556MEDIUMHCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiationEPSS 0.4%CVE-2023-45705LOWHCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2021-27761MEDIUMHCL BigFix Platform is affected by weak web transport securityEPSS 0.4%CVE-2023-37531LOWA cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformEPSS 0.4%