CVE-2022-38655

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Dec 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-386569.8HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative CVE-2022-386575.4An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.CVE-2022-386587.5BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive da CVE-2022-386597.8In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2022-38664.3HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that b CVE-2022-386608.8HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit thi CVE-2022-386617.1HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.CVE-2022-386626.1In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.CVE-2022-386636.5Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git CVE-2022-386645.4Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History pag CVE-2022-386656.5Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins co CVE-2022-386667.5Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname valid