6.6
Medium
CVE-2023-28025 Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert…
Description
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed and stored in the server storage.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL BigFix Mobile / Modern Client Management 3.1 | earliest → 3.1 | No fix stated |
Other CVEs of HCL BigFix Mobile / Modern Client Management
The 4 CVEs of HCL BigFix Mobile / Modern Client Management →
CVE-2021-27781
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie
6.6
Medium
CVE-2021-27780
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment
5.3
Medium
CVE-2021-27783
User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed
6.8
Medium