CVE-2026-108013: falha de média gravidade em HCL Software BigFix Platform
HCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.2%
BigFix Platform uses Mozilla CA certificate bundle (PEM). Versions of the bundle dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application. The issue is resolved by using bundle version 2026/10/20 or later. The fixed bundle is available starting from BES Support v1520.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Produtos afetados
HCL Software · BigFix PlatformCVEs relacionadas — HCL Software BigFix Platform
No mesmo produto, das mais perigosas para as menos.
CVE-2023-37536HIGHHCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3EPSS 1.9%CVE-2021-27762MEDIUMHCL BigFix Platform is affected by misconfigured security-related HTTP headersEPSS 0.7%CVE-2023-45715LOWHCL BigFix Platform is susceptible to a Denial of Service attackEPSS 0.4%CVE-2024-23556MEDIUMHCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiationEPSS 0.4%CVE-2023-45705LOWHCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)EPSS 0.4%CVE-2021-27761MEDIUMHCL BigFix Platform is affected by weak web transport securityEPSS 0.4%