Bigfix Aex
Monthly
Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on the server and then access or download uploaded content without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows the issue is reachable over the network at low complexity with no authentication or user interaction, and the supplied CPE identifies the affected product without a narrower version boundary. No CISA KEV entry or public exploit was identified at time of analysis, but the issue is assessed as a credible high-priority item to address this week rather than an emergency.
Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.
HCL BigFix AEX V13.0 contains a flaw in its bundled aws-sdk package that can cause AWS API requests to be directed to unintended or non-AWS endpoints, with limited confidentiality impact. The issue is rated CVSS 3.7 with high attack complexity and no authentication or user interaction required; the specific exploitation preconditions are not described in the available sources. No public exploit code or active exploitation is identified at time of analysis.
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send requests to external resources, which could expose limited information or enable limited unauthorized actions against reachable services. The flaw is rated CVSS 4.2 with high attack complexity and no availability impact, and the supplied intelligence assigns it a this-month remediation priority. No public exploit code or CISA KEV confirmation is present in the supplied data, and exploitation requires a valid low-privilege session rather than being an unauthenticated default-configuration attack.
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through improperly handled errors and exceptional conditions, handing low-privilege authenticated users reconnaissance material that can support follow-on attacks. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) makes valid, if limited, credentials the primary limiting factor: this is not a pre-authentication or drive-by issue, and there is no integrity or availability impact. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this a moderate-severity information-disclosure issue rather than a top-tier emergency.
Unauthenticated remote file upload and direct retrieval weaknesses in HCL BigFix AEX allow attackers to place files on the server and then access or download uploaded content without proper authorization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) shows the issue is reachable over the network at low complexity with no authentication or user interaction, and the supplied CPE identifies the affected product without a narrower version boundary. No CISA KEV entry or public exploit was identified at time of analysis, but the issue is assessed as a credible high-priority item to address this week rather than an emergency.
Remote code execution in HCL BigFix AEX is reachable over the network with low attack complexity, but the CVSS vector requires a high-privilege account (PR:H), so an attacker must already hold privileged access to the product before exploiting the code-injection flaw (CWE-94). The scope change (S:C) indicates that successful exploitation can affect resources beyond the vulnerable component, with high confidentiality, integrity, and availability impact. No public exploit has been identified at the time of analysis, and the vendor advisory KB0134281 is the primary reference; the vuln.today decision label is act_now.
HCL BigFix AEX V13.0 contains a flaw in its bundled aws-sdk package that can cause AWS API requests to be directed to unintended or non-AWS endpoints, with limited confidentiality impact. The issue is rated CVSS 3.7 with high attack complexity and no authentication or user interaction required; the specific exploitation preconditions are not described in the available sources. No public exploit code or active exploitation is identified at time of analysis.
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send requests to external resources, which could expose limited information or enable limited unauthorized actions against reachable services. The flaw is rated CVSS 4.2 with high attack complexity and no availability impact, and the supplied intelligence assigns it a this-month remediation priority. No public exploit code or CISA KEV confirmation is present in the supplied data, and exploitation requires a valid low-privilege session rather than being an unauthenticated default-configuration attack.
Clickjacking in the HCL BigFix AEX web interface allows remote attackers to embed the application in a malicious page or iframe and trick a logged-in administrator or operator into performing unintended actions with their own privileges, which can result in unauthorized configuration or account changes. The flaw is a missing or ineffective anti-framing control (CWE-1021); the supplied vendor advisory reference (KB0134281) does not specify which control is absent, and the CPE entry (cpe:2.3:a:hcl_software:bigfix_aex) carries no version boundary, so the affected build range is not enumerated in the available data. Exploitation depends on a victim with an active AEX session being socially engineered into visiting the attacker's page and interacting with the overlaid UI, so it fails against logged-out users and against deployments that already emit X-Frame-Options or a CSP frame-ancestors directive; no public exploit was identified at time of analysis and the issue is not in CISA KEV. Our independent assessment rates this moderate and not urgent (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), narrower in impact than the vendor's 6.4 score, with the priority label indicating remediation is appropriate within the current monthly cycle rather than as an emergency.
HCL BigFix AEX discloses sensitive technical detail - stack traces, system information and internal file paths - through improperly handled errors and exceptional conditions, handing low-privilege authenticated users reconnaissance material that can support follow-on attacks. The assessed vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) makes valid, if limited, credentials the primary limiting factor: this is not a pre-authentication or drive-by issue, and there is no integrity or availability impact. No public exploit has been identified at time of analysis and the CVE is not in CISA KEV; independent assessment rates this a moderate-severity information-disclosure issue rather than a top-tier emergency.