HCL BigFix SaaS Authentication Service Cache Poisoning Vulnerability

A cache poisoning vulnerability has been identified in the HCL BigFix SaaS Authentication Service. This issue arises because the HTTP responses from BigFix SaaS include the Origin header. When this header is reflected without proper validation, it creates an opportunity for cache poisoning attacks.

Impact

Exploitation of this vulnerability can lead to cache poisoning, where maliciously crafted responses are stored and potentially served to users, causing them to receive incorrect or harmful data.

Remediation

Users can upgrade to the latest versions of HCL BigFix SaaS Remediate Front End Applications and Back End Services to address this vulnerability. Specific version details can be found in the HCL BigFix SaaS Remediate Security Bulletin.