What is CVE-2023-28016?

CVE-2023-28016 is a low-severity vulnerability in Hcl Software Bigfix Osd Bare Metal Server, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.1/10. Published 2023-06-22.

How severe is CVE-2023-28016?

Low severity. CVSS v3 base score is 3.1 out of 10.

Vulnerability in Hcl Software Bigfix Osd Bare Metal Server

CVE-2023-28016

Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.

EPSS: 0.003 (22.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Hcl Software Bigfix Osd Bare Metal Server — versions < 311.12
Hcltech Bigfix_osd_bare_metal_server

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

psirt@hcl.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-28016?: CVE-2023-28016 is a low-severity vulnerability in Hcl Software Bigfix Osd Bare Metal Server, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.1/10. Published 2023-06-22.
How severe is CVE-2023-28016?: Low severity. CVSS v3 base score is 3.1 out of 10.