{"id":"CVE-2024-42194","aliases":["EUVD-2024-39893","GHSA-cr9c-4pg9-32j3"],"status":"published","title":"HCL BigFix Inventory is affected by an access control vulnerability","description":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.","severity":{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00264,"percentile":0.18511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-280"],"published":"2024-12-17T17:28:24Z","modified":"2026-06-17T07:49:01Z","products":[{"vendor":"hcl software","product":"bigfix inventory"}],"references":[{"url":"https://https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0118212"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42194"},{"url":"https://github.com/advisories/GHSA-cr9c-4pg9-32j3"}],"sources":{"cve":[{"id":"CVE-2024-42194","title":"HCL BigFix Inventory is affected by an access control vulnerability","description":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.","status":"published","published":"2024-12-17T17:28:24.872Z","modified":"2024-12-17T20:37:59.293Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-280"],"updated_at":"2026-11-02T14:34:03.00063Z"}],"euvd":[{"id":"EUVD-2024-39893","description":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.","status":"published","published":"2024-12-17T17:28:24Z","modified":"2024-12-17T20:37:59Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:04:34.500778Z"}],"ghsa":[{"id":"GHSA-cr9c-4pg9-32j3","title":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An...","description":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.","status":"published","published":"2024-12-17T18:33:50Z","modified":"2024-12-17T18:34:00Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-280"],"updated_at":"2026-11-02T14:59:13.042537Z"}],"nvd":[{"id":"CVE-2024-42194","description":"An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.","status":"published","published":"2024-12-17T18:15:23.59Z","modified":"2026-06-17T07:49:01.23Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-280"],"updated_at":"2026-11-02T14:10:40.507978Z"}]}}