HCL BigFix WebUI Host Header Poisoning Vulnerability

A host header poisoning vulnerability has been identified in the HCL BigFix WebUI application. This issue arises because the application inadvertently exposes host information from the HTTP header, creating a potential vector for host header poisoning attacks. The vulnerability affects all versions of the BigFix WebUI application.

Impact

Exploitation of this vulnerability could lead to host header poisoning, allowing attackers to manipulate how the application interprets host headers. This could potentially be used to redirect users, interfere with application logic, or bypass security controls.

Remediation

Users are advised to upgrade to the latest version of HCL BigFix WebUI. Specific version recommendations can be found in the HCL BigFix WebUI Security Bulletin KB0124562.