HCL BigFix Service Management Content Security Policy Misconfiguration Vulnerability Allowing Cross-Site Scripting

A security misconfiguration vulnerability has been identified in HCL BigFix Service Management (SM) version 23. This vulnerability arises from an improper Content Security Policy (CSP) header, which could enable attackers to inject malicious scripts. Such an injection would increase the risk of cross-site scripting (XSS) attacks and the potential exposure of sensitive information.

Impact

Exploitation of this vulnerability could lead to cross-site scripting (XSS) attacks, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users can upgrade to HCL BigFix Service Management (SM) version 27 to address this vulnerability.