CVE-2023-28019 MEDIUM

CVE-2023-28019: An SQL injection affects BigFix WebUI API

Vendor Hcl Software
Product HCL BigFix WebUI API
Published July 18, 2023
Last update October 21, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameterized SQL query.

Key dates

02Disclosure timeline

July 18, 2023 CVE published
October 21, 2024 Record updated