VULNERABILITY INTELLIGENCE

CVE-2023-37520

CVSS score7.7 HIGH
EPSS probability0.25%
CISA KEVNot currently listed
Published2023-12-21
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

Weakness classification

  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references