CVE-2023-37521 HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosure

Low 2.3 Published 16 Jan 2024 Updated 29 Oct 2024

An attacker can access sensitive information exposed in query strings within the HCL BigFix OSD Bare Metal Server WebUI.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-37521?

CVE-2023-37521 is a low-severity vulnerability in HCL BigFix OSD Bare Metal Server WebUI, published on 16 Jan 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

HCL BigFix Bare OSD Metal Server WebUI version 311.19 or lower can sometimes include sensitive information in a query string which could allow an attacker to execute a malicious attack.

Weakness: CWE-922

Which versions are affected by CVE-2023-37521?

It affects 1 product.

Products include Hcltechsw Bigfix Bare Osd Metal Server Webui.

How do I fix CVE-2023-37521?

No fix has been published for CVE-2023-37521 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-37521 being exploited?

There is no known exploitation of CVE-2023-37521 in the wild and no public exploit code.

Sources

Also known as GHSA-8rx5-h8wm-642c.