---
cve: "CVE-2023-37520"
severity: "HIGH"
cvss: 7.7
epss: "0.3%"
vendor: "HCL Software"
kev: false
exploited: false
published: "2023-12-21 23:15:08"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-21T10:59:39+02:00"
---

# CVE-2023-37520

> 7.7 HIGH

## Beschreibung

Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68, allowing for potential data exfiltration. This XSS vulnerability is in the Gather Status Report, which is served by the BigFix Relay.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Hoch | good |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Referenzen

- <https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109376>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2023-37520) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_