CVE-2024-42185
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
HCL BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
- Record
CVE-2024-42185- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2024-39450
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
- Record
EUVD-2024-39450- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c947-vcqx-5wf7
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML...
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
- Record
GHSA-c947-vcqx-5wf7- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.
- Record
CVE-2024-42185- CVSS 3.1
- 2.5 Low
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N - Weakness
- CWE-611
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-42185 is a low vulnerability (CVSS 2.5) in Hcl Software Bigfix Patch Management Download Plug-ins, published January 23, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. No source names a fixed version.