CVE-2023-37518 MEDIUM

CVE-2023-37518: A code injection vulnerability affects HCL BigFix ServiceNow Data Flow

Vendor Hcl Software
Product BigFix ServiceNow Data Flow
Published January 30, 2024
Last update May 29, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary code and execute within the context of the running user.

Key dates

02Disclosure timeline

January 30, 2024 CVE published
May 29, 2025 Record updated