« Volver al listado

CVE-2024-23554

Estado: AnalizadaAlta (8.8)—

Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Hcltech — Bigfix Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23554",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23554",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-18T16:01:25.373325Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@hcl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@hcl.com",
      "affectedData": [
        {
          "vendor": "HCL Software",
          "product": "BigFix Platform",
          "versions": [
            {
              "status": "affected",
              "version": "9.5 - 9.5.24, 10 - 10.0.11, 11.0.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:hcltech:bigfix_platform:9.5:*:*:*:*:*:*:*"
          ],
          "vendor": "hcltech",
          "product": "bigfix_platform",
          "versions": [
            {
              "status": "affected",
              "version": "9.5",
              "versionType": "custom",
              "lessThanOrEqual": "9.5.24"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:hcltech:bigfix_platform:10.0.0:*:*:*:*:*:*:*"
          ],
          "vendor": "hcltech",
          "product": "bigfix_platform",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.0.11"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "cpes": [
            "cpe:2.3:a:hcltech:bigfix_platform:11.0.1:*:*:*:*:*:*:*"
          ],
          "vendor": "hcltech",
          "product": "bigfix_platform",
          "versions": [
            {
              "status": "affected",
              "version": "11.0.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-05-18T00:15:07.337",
  "references": [
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113140",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@hcl.com"
    },
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0113140",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@hcl.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE). \n"
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el token de sesión que podría conducir a la ejecución remota de código (RCE)."
    }
  ],
  "lastModified": "2026-06-17T07:13:09.233",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89381821-8CEB-4749-BDF3-96ACAE9030BE",
              "versionEndExcluding": "9.5.25",
              "versionStartIncluding": "9.5"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D8384CC0-439E-4627-A8CB-83612ECD933D",
              "versionEndExcluding": "10.0.12",
              "versionStartIncluding": "10"
            },
            {
              "criteria": "cpe:2.3:a:hcltech:bigfix_platform:11.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FF4B799-AA71-4FB2-BF63-2C5D9BE02AD8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@hcl.com"
}