2 lines
2.9 KiB
JSON
2 lines
2.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"BigFix Modern Client Management","vendor":"HCL Software","versions":[{"status":"affected","version":"<=3.3"}]}],"source":"psirt@hcl.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:hcltech:bigfix_mobile:*:*:*:*:*:*:*:*","matchCriteriaId":"97CEC651-375F-4FE8-B947-0A3D89FF0267","versionEndIncluding":"3.3","vulnerable":true},{"criteria":"cpe:2.3:a:hcltech:bigfix_modern_client_management:*:*:*:*:*:*:*:*","matchCriteriaId":"251EA75C-E4D9-4A13-B13D-02DFF9E6161D","versionEndExcluding":"3.4","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content."},{"lang":"es","value":"HCL BigFix Modern Client Management (MCM) 3.3 y versiones anteriores son vulnerables a ciertas directivas inseguras dentro de la Política de Seguridad de Contenido (CSP). Un atacante podría engañar a los usuarios para que realicen acciones al no restringir adecuadamente las fuentes de scripts y otro contenido."}],"id":"CVE-2025-0276","lastModified":"2026-10-08T11:10:00.250","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"exploitabilityScore":3.9,"impactScore":2.5,"source":"psirt@hcl.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.7,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0276","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-10-16T14:10:38.115370Z","version":"2.0.3"}}]},"published":"2025-10-16T09:15:31.690","references":[{"source":"psirt@hcl.com","tags":["Vendor Advisory"],"url":"https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513"}],"sourceIdentifier":"psirt@hcl.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"},{"lang":"en","value":"CWE-80"},{"lang":"en","value":"CWE-693"}],"source":"psirt@hcl.com","type":"Secondary"}]}
|