Bigfix Webui
CVE-2023-28021
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
The BigFix WebUI uses weak cipher suites.
AnalysisAI
The BigFix WebUI uses weak cipher suites. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-326. Affected products include: Hcltech Bigfix Webui.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Bigfix Webui
View allInsufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL querie
A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and befor
URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external si
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixl
HCL BigFix WebUI is vulnerable to stored cross-site scripting (XSS) within the Apps->Software module. Rated medium sever
An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privile
A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to vie
Same weakness CWE-326 – Inadequate Encryption Strength
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today