Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-30142: HCL BigFix Compliance: Cookies May Be Stolen by Attackers

CVE-2024-30142 · published 1 year ago

Summary

HCL BigFix Compliance is a software used for compliance and security management. If an attacker uses a technique called cross-site scripting (XSS), they may be able to steal sensitive information, such as login credentials or session data, stored in cookies. To protect against this, ensure the secure flag is set for cookies in HCL BigFix Compliance.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
hcltech	bigfix_compliance	2.0.11 `cpe:2.3:a:hcltech:bigfix_compliance:2.0.11:::::::*`

Original advisory text

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session coo...

HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0117197 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.8 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-614Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Timeline

Published7 Nov 2024

Updated30 Sep 2026

First seen7 Mar 2026

Sources

CVE-2024-30142 · NVD

Track software like this

Free during beta