CVE-2023-28016

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
HCL Software	HCL BigFix OSD Bare Metal Server	< 311.12

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105601Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0105601Vendor Advisory

Timeline

Published: Jun 22, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-280175.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in CVE-2023-280186.5HCL Connections is vulnerable to a denial of service, caused by improper validation on certain requests. Using a specially-crafted request a CVE-2023-280198.8Insufficient validation in Bigfix WebUI API App site version < 14 allows an authenticated WebUI user to issue SQL queries via an unparameter CVE-2023-28024.8The Ultimate Addons for Contact Form 7 WordPress plugin before 3.1.29 does not sanitise and escape some of its settings, which could allow h CVE-2023-280206.1URL redirection in Login page in HCL BigFix WebUI allows malicious user to redirect the client browser to an external site via redirect URL CVE-2023-280217.5The BigFix WebUI uses weak cipher suites.CVE-2023-280226.5HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are n CVE-2023-280236.5A cross site request forgery vulnerability in the BigFix WebUI Software Distribution interface site version 44 and before allows an NMO atta CVE-2023-280254.8Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a c CVE-2023-280266.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potent CVE-2023-280276.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potent CVE-2023-280286.7Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potent