{"id":"CVE-2023-37520","aliases":["EUVD-2023-41407","GHSA-hrwf-qr34-wrcx"],"status":"published","title":"HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)","description":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.","severity":{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00251,"percentile":0.16568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-12-21T22:13:47Z","modified":"2026-06-17T06:08:22Z","products":[{"vendor":"hcl software","product":"hcl bigfix platform"},{"vendor":"hcltech","product":"bigfix_platform"}],"references":[{"url":"https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0109376","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37520"},{"url":"https://github.com/advisories/GHSA-hrwf-qr34-wrcx"}],"sources":{"cve":[{"id":"CVE-2023-37520","title":"HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)","description":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.\n","status":"published","published":"2023-12-21T22:13:47.339Z","modified":"2024-08-02T17:16:30.415Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:35:16.126506Z"}],"euvd":[{"id":"EUVD-2023-41407","description":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.\n","status":"published","published":"2023-12-21T22:13:47Z","modified":"2024-08-02T17:16:30Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:03.310621Z"}],"ghsa":[{"id":"GHSA-hrwf-qr34-wrcx","title":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server...","description":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.\n","status":"published","published":"2023-12-22T00:30:31Z","modified":"2023-12-29T21:30:46Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:55:18.128107Z"}],"nvd":[{"id":"CVE-2023-37520","description":"Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.\n","status":"published","published":"2023-12-21T23:15:08.453Z","modified":"2026-06-17T06:08:22.273Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:57.117371Z"}]}}