CVE-2023-28025 An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management
A Master operator can inject SVG tags to trigger stored XSS, potentially stealing cookies and compromising user sessions in HCL BigFix Mobile.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28025?
CVE-2023-28025 is a medium-severity cross-site scripting vulnerability in HCL BigFix Mobile / Modern Client Management, published on 21 Dec 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
Weakness: CWE-79
Which versions are affected by CVE-2023-28025?
It affects 1 product.
Products include Hcltech Bigfix Modern Client Management.
How do I fix CVE-2023-28025?
No fix has been published for CVE-2023-28025 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-28025 being exploited?
There is no known exploitation of CVE-2023-28025 in the wild and no public exploit code.
Sources
Also known as GHSA-5c4j-jvmg-2xq2.