HCL BigFix Patch Download Plug-ins Arbitrary File Download Vulnerability

An arbitrary file download vulnerability has been identified in HCL BigFix Patch Download Plug-ins, specifically in versions prior to 1177. This vulnerability allows a malicious operator to download files from any URL without proper validation or allowlist controls.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files or data.

Remediation

Users can upgrade to HCL BigFix Patching Support, site version 1177 or later. Instructions for upgrading are available in the HCL BigFix Patch Management Download Plug-ins Security Bulletin.