Lucene search

[email protected]CVE-2022-38655

HistoryDec 21, 2022 - 5:15 p.m.

CVE-2022-38655

2022-12-2117:15:09

[email protected]

web.nvd.nist.gov

cve-2022-38655

bigfix

webui

non-master operators

fixlets

relevance modification

deployment

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%

JSON

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

Affected configurations

NVD

Node

hcltechbigfix_webuiMatch20

CPENameOperatorVersion
hcltech:bigfix_webuihcltech bigfix webuieq20

CPE	Name	Operator	Version
hcltech:bigfix_webui	hcltech bigfix webui	eq	20

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BigFix WebUI",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "20"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102140

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

5.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.7%

JSON

Related for CVE-2022-38655

nvd1 cvelist1 prion1