Monthly
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.
HCL Aftermarket DPC versions up to 1.0.0 contain an admin session concurrency vulnerability that allows authenticated attackers with low privileges to hijack or impersonate administrator sessions through exploitation of improper concurrent session handling. The vulnerability requires user interaction and has moderate attack complexity, resulting in partial confidentiality and availability impact. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, indicating limited real-world exploitation pressure despite the administrative access implications.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.
Session invalidation failure in HCL IntelliOps Event Management (IEM) v1.3 and v1.4 allows session tokens to persist as valid after an admin explicitly logs out or an administrator deletes the session. An attacker who has previously captured a valid session token - through network interception, XSS, or other means - can replay that token post-logout to retain unauthorized access to admin-level functionality. No public exploit code has been identified at time of analysis, and EPSS/KEV data are not available for this CVE.
HCL Aftermarket DPC versions up to 1.0.0 contain an admin session concurrency vulnerability that allows authenticated attackers with low privileges to hijack or impersonate administrator sessions through exploitation of improper concurrent session handling. The vulnerability requires user interaction and has moderate attack complexity, resulting in partial confidentiality and availability impact. No public exploit has been identified at time of analysis, and CISA has not listed this in the KEV catalog, indicating limited real-world exploitation pressure despite the administrative access implications.