CVE-2024-30141 HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information
Attackers can obtain sensitive environment or user data via detailed error messages in HCL BigFix Compliance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-30141?
CVE-2024-30141 is a medium-severity vulnerability in HCL Software BigFix Compliance, published on 7 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information. Detailed error messages can provide enticement information or expose information about its environment, users, or associated data.
Weakness: CWE-209
Which versions are affected by CVE-2024-30141?
It affects 1 product.
Products include Hcltech Bigfix Compliance.
How do I fix CVE-2024-30141?
No fix has been published for CVE-2024-30141 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-30141 being exploited?
There is no known exploitation of CVE-2024-30141 in the wild and no public exploit code.
Other vulnerabilities in HCL Software BigFix Compliance
- CVE-2021-27756 Weak cryptography in "BigFix Compliance Server"
- CVE-2024-30125 HCL BigFix Compliance is affected by an internal server error
- CVE-2024-42212 HCL BigFix Compliance is affected by an improper or missing SameSite attribute
- CVE-2024-30140 HCL BigFix Compliance is affected by unvalidated redirects and forwards
- CVE-2023-37525 HCL BigFix Compliance is vulnerable to a sensitive information disclosure
Sources
Also known as GHSA-742p-rh42-xg84.