CVE-2024-42185

LowCVSS 2.5/10Last modified Jun 17, 2026

Description

BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This allows an attacker to exploit this vulnerability by injecting malicious XML content, which can lead to various issues including denial of service and unauthorized access.

Metrics

CVSS 3.1 2.5/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-421862.8BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handling of SSL certificate CVE-2024-421875.3BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to download files from a CVE-2024-421884.6HCL Connections is vulnerable to a broken access control vulnerability that may allow an unauthorized user to update data in certain scenari CVE-2024-421896.5HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.CVE-2024-42199.1Prior to 23.2, it is possible to perform arbitrary Server-Side requests via HTTP-based connectors within BeyondInsight, resulting in a serve CVE-2024-421909.8HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace CVE-2024-421919.8HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a COM hijacking vulnerability which could allow an attacker to modify or replace CVE-2024-421925.5HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or CVE-2024-421938.1HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation. This scenario CVE-2024-421943.1An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory. An attacker having access via a read-only acco CVE-2024-421956.8HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web CVE-2024-421965.5HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.