HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2epss 0.2%
exploitation probability
0.2%top 92% of all CVEs
observed exploitation
nono source reports it
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Affected products
HCLSoftware · BigFix IVR