fkie_nvd - fkie_cve-2024-42194

fkie_cve-2024-42194

Vulnerability from fkie_nvd

Published

2024-12-17 18:15

Modified

2024-12-17 18:15

Severity ?

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.

References

▼	URL	Tags
	psirt@hcl.com	https://https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118212

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call."
    },
    {
      "lang": "es",
      "value": "Una gesti\u00f3n inadecuada de permisos o privilegios insuficientes afecta a HCL BigFix Inventory. Un atacante que tenga acceso a trav\u00e9s de una cuenta de solo lectura podr\u00eda cambiar ciertos par\u00e1metros de configuraci\u00f3n manipulando una llamada a la API REST espec\u00edfica."
    }
  ],
  "id": "CVE-2024-42194",
  "lastModified": "2024-12-17T18:15:23.590",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.1,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 1.4,
        "source": "psirt@hcl.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-12-17T18:15:23.590",
  "references": [
    {
      "source": "psirt@hcl.com",
      "url": "https://https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0118212"
    }
  ],
  "sourceIdentifier": "psirt@hcl.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        }
      ],
      "source": "psirt@hcl.com",
      "type": "Secondary"
    }
  ]
}

cve-2024-42194

Vulnerability from cvelistv5

Published

2024-12-17 17:28

Modified

2024-12-17 20:37

Severity ?

3.1 (Low) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Summary

An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.

References

▼	URL	Tags
	https://https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118212

Impacted products

	Vendor	Product	Version
	HCL Software	BigFix Inventory	Version: v9.x, v10.x, v11.0.0.0, v11.0.1.0

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42194",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-17T20:35:20.681983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-17T20:37:59.293Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "BigFix Inventory",
          "vendor": "HCL Software",
          "versions": [
            {
              "status": "affected",
              "version": "v9.x, v10.x, v11.0.0.0, v11.0.1.0"
            }
          ]
        }
      ],
      "datePublic": "2024-12-17T17:20:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call."
            }
          ],
          "value": "An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280  Improper Handling of Insufficient Permissions or Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-17T17:28:24.872Z",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "url": "https://https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0118212"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HCL BigFix Inventory is affected by an access control vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2024-42194",
    "datePublished": "2024-12-17T17:28:24.872Z",
    "dateReserved": "2024-07-29T21:32:08.371Z",
    "dateUpdated": "2024-12-17T20:37:59.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.