Vulnerability · Published Dec 17, 2024 · Assigned by HCL
CVE-2024-42194HCL BigFix Inventory is affected by an access control vulnerability
Low 3.1
In plain English
A low-severity security flaw in BigFix Inventory from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)3.1Low
Exploit odds (30 days)0.3%top 81.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | BigFix Inventory | v9.x, v10.x, v11.0.0.0, v11.0.1.0 |
Weakness: CWE-280 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N