HCL BigFix Patch Download Plug-ins Server-Side Request Forgery Vulnerability
Vulnerability
A Server-Side Request Forgery (SSRF) vulnerability has been identified in HCL BigFix Patch Download Plug-ins. This vulnerability allows the application to download files from an internally hosted server on localhost. It affects BigFix Patch and Patching Support, site versions prior to 1177.
Impact
Exploitation of this vulnerability could lead to unauthorized file downloads from internal servers, potentially allowing for further attacks or data exposure.
Remediation
Users can upgrade to HCL BigFix Patching Support, site version 1177 or later. Instructions for upgrading are available in the HCL BigFix Patch Management Download Plug-ins Security Bulletin.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.