CVE-2024-42212mediumCWE-1275

CVE-2024-42212: medium-severity vulnerability in HCL BigFix Compliance

HCL BigFix Compliance is affected by an improper or missing SameSite attribute

Published

Follow this CVE+ Monitor BigFix Compliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.3%
In short

HCL BigFix Compliance lacks proper cookie protection, allowing attackers on malicious websites to trick your browser into performing unwanted actions while you're logged in.

Technical detail

The application fails to set or properly configure the SameSite attribute on cookies, enabling Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious site that, when visited by an authenticated user, triggers unintended requests to BigFix Compliance using the victim's session cookies.

Summary generated and translated by AI from the official description.
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
HCL Software · HCL BigFix Compliance
Related CVEs — HCL BigFix Compliance

In the same product, most dangerous first.

CVE-2024-42213MEDIUMHCL BigFix Compliance is affected by inclusion of temporary files left in the production environmentEPSS 0.3%