HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery (CSRF) attacks, where a malicious site could trick a users browser into making unintended requests using authenticated sessions.
Weakness
The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bigfix_compliance | Hcltech | 2.0.12 (including) | 2.0.12 (including) |
Potential Mitigations
Related Attack Patterns
References
- https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0120961