HCL BigFix Service Management HTTP Request Smuggling Vulnerability

A HTTP request smuggling vulnerability has been identified in HCL BigFix Service Management version 23. This vulnerability arises from inconsistent HTTP request parsing between front-end and back-end servers, allowing attackers to bypass security measures and potentially hijack requests or poison caches.

Impact

Exploitation of this vulnerability could lead to HTTP request smuggling, allowing attackers to manipulate request handling between servers. This could be used to bypass security controls, hijack requests, or poison caches.

Remediation

Users can upgrade to HCL BigFix Service Management version 26 to address this vulnerability.