CVE-2023-45705 - Vulnerability Details

Vendors	Products
Hcltech	Bigfix Platform

Link	Providers
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Hcltech Hcltech bigfix Platform
Weaknesses		CWE-918
CPEs		cpe:2.3:a:hcltech:bigfix_platform::::::::
Vendors & Products		Hcltech Hcltech bigfix Platform

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-45705", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2023-10-10T21:26:08.718Z", "datePublished": "2024-03-28T14:11:57.835Z", "dateUpdated": "2025-03-28T20:48:19.707Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "BigFix Platform", "vendor": "HCL Software", "versions": [{"status": "affected", "version": "10.0 - 10.0.10, 11.0.0 - 11.0.1"}]}], "datePublic": "2024-03-28T04:10:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.</span><br>"}], "value": "An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2024-03-28T14:11:57.835Z"}, "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972"}], "source": {"discovery": "UNKNOWN"}, "title": "HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-28T17:50:43.021560Z", "id": "CVE-2023-45705", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T20:48:19.707Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.503Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-45705 (string)

assignerOrgId : 1e47fe04-f25f-42fa-b674-36de2c5e3cfc (string)

state : PUBLISHED (string)

assignerShortName : HCL (string)

dateReserved : 2023-10-10T21:26:08.718Z (string)

datePublished : 2024-03-28T14:11:57.835Z (string)

dateUpdated : 2025-03-28T20:48:19.707Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : BigFix Platform (string)

vendor : HCL Software (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0 - 10.0.10, 11.0.0 - 11.0.1 (string)

}

]

}

]

datePublic : 2024-03-28T04:10:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. (string)

}

]

value : An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

providerMetadata : { »

orgId : 1e47fe04-f25f-42fa-b674-36de2c5e3cfc (string)

shortName : HCL (string)

dateUpdated : 2024-03-28T14:11:57.835Z (string)

}

references : [ »

0 : { »

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF) (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-918 (string)

lang : en (string)

description : CWE-918 Server-Side Request Forgery (SSRF) (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-03-28T17:50:43.021560Z (string)

id : CVE-2023-45705 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-28T20:48:19.707Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T20:29:32.503Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.503Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-45705", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-28T17:50:43.021560Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:19.813Z"}}], "cna": {"title": "HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCL Software", "product": "BigFix Platform", "versions": [{"status": "affected", "version": "10.0 - 10.0.10, 11.0.0 - 11.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2024-03-28T04:10:00.000Z", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.</span><br>", "base64": false}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2024-03-28T14:11:57.835Z"}}}, "cveMetadata": {"cveId": "CVE-2023-45705", "state": "PUBLISHED", "dateUpdated": "2025-03-28T20:48:19.707Z", "dateReserved": "2023-10-10T21:26:08.718Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2024-03-28T14:11:57.835Z", "assignerShortName": "HCL"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T20:29:32.503Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-45705 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-03-28T17:50:43.021560Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-918 (string)

description : CWE-918 Server-Side Request Forgery (SSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-23T19:01:19.813Z (string)

}

]

cna : { »

title : HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF) (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 3.5 (number)

attackVector : NETWORK (string)

baseSeverity : LOW (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : HCL Software (string)

product : BigFix Platform (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0 - 10.0.10, 11.0.0 - 11.0.1 (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-03-28T04:10:00.000Z (string)

references : [ »

0 : { »

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. (string)

base64 : false (boolean)

}

]

}

]

providerMetadata : { »

orgId : 1e47fe04-f25f-42fa-b674-36de2c5e3cfc (string)

shortName : HCL (string)

dateUpdated : 2024-03-28T14:11:57.835Z (string)

}

cveMetadata : { »

cveId : CVE-2023-45705 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-28T20:48:19.707Z (string)

dateReserved : 2023-10-10T21:26:08.718Z (string)

assignerOrgId : 1e47fe04-f25f-42fa-b674-36de2c5e3cfc (string)

datePublished : 2024-03-28T14:11:57.835Z (string)

assignerShortName : HCL (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "80321354-E654-4293-AC45-7CC416E716EA", "versionEndExcluding": "10.0.11", "versionStartIncluding": "10", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "D345572A-6C9A-462F-B773-8E02E8B629D2", "versionEndExcluding": "11.0.2", "versionStartIncluding": "11.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options.\n"}, {"lang": "es", "value": "Un usuario administrativo de WebReports puede realizar un exploit de Server Side Request Forgery (SSRF) a trav\u00e9s de las opciones de configuraci\u00f3n SMTP."}], "id": "CVE-2023-45705", "lastModified": "2025-03-28T21:15:15.000", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 2.5, "source": "psirt@hcl.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-03-28T15:15:45.590", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 80321354-E654-4293-AC45-7CC416E716EA (string)

versionEndExcluding : 10.0.11 (string)

versionStartIncluding : 10 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:* (string)

matchCriteriaId : D345572A-6C9A-462F-B773-8E02E8B629D2 (string)

versionEndExcluding : 11.0.2 (string)

versionStartIncluding : 11.0.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An administrative user of WebReports may perform a Server Side Request Forgery (SSRF) exploit through SMTP configuration options. (string)

}

1 : { »

lang : es (string)

value : Un usuario administrativo de WebReports puede realizar un exploit de Server Side Request Forgery (SSRF) a través de las opciones de configuración SMTP. (string)

}

]

id : CVE-2023-45705 (string)

lastModified : 2025-03-28T21:15:15.000 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.9 (number)

impactScore : 2.5 (number)

source : psirt@hcl.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-03-28T15:15:45.590 (string)

references : [ »

0 : { »

source : psirt@hcl.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0111972 (string)

}

]

sourceIdentifier : psirt@hcl.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-918 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-918 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object