Vulnerability · Published Dec 20, 2022 · Assigned by HCL
CVE-2022-38655HCL BigFix WebUI is affected by a missing-permission-check vulnerability
Medium 6.4
In plain English
A medium-severity improper access control in BigFix WebUI from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.4%top 64.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | BigFix WebUI | 20 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L