CVE-2023-37520

6.1 mediumEPSS 0.3%

Medium (6.1) in hcltech bigfix platform. EPSS 0.3% chance of exploitation in the next 30 days.

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2023-12-21
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hcltech:bigfix_platform

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376

Check your stack JSON