CVE-2024-42189
CVE-2024-42189 is a medium-severity vulnerability in Hcltech Bigfix Platform with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1287.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 5.6
- EPSS exploit prediction: 0% (18th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-54501
- Weakness: CWE-1287
- Affected product: Hcltech Bigfix Platform
- Published:
- Last modified:
Description
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
Frequently asked questions
- What is CVE-2024-42189?
- HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
- How severe is CVE-2024-42189?
- CVE-2024-42189 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2024-42189 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (18th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-42189?
- CVE-2024-42189 affects Hcltech Bigfix Platform. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-42189?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2024-42189 have an EU (EUVD) identifier?
- Yes. CVE-2024-42189 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-54501.
- When was CVE-2024-42189 published?
- CVE-2024-42189 was published on 2025-04-15 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*
More vulnerabilities in Hcltech Bigfix Platform
- CVE-2026-21765 — High (CVSS 8.8): HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys…
- CVE-2023-37536 — High (CVSS 8.2): An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via…
- CVE-2024-42193 — High (CVSS 8.1): HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate…
- CVE-2023-37520 — High (CVSS 7.7): Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability identified in BigFix Server version 9.5.12.68,…
- CVE-2023-37519 — High (CVSS 7.7): Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. This XSS vulnerability is in the Download Status…
- CVE-2020-14254 — High (CVSS 7.5): TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not…
All CVEs affecting Hcltech Bigfix Platform →
Other CWE-1287 vulnerabilities
- CVE-2024-51550 — Critical (CVSS 10.0): Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in…
- CVE-2024-6298 — Critical (CVSS 10.0): Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series…
- CVE-2026-44935 — Critical (CVSS 9.9): Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before…
- CVE-2024-4879 — Critical (CVSS 9.8): ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now…
- CVE-2021-32024 — Critical (CVSS 9.8): A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an…
- CVE-2026-24307 — Critical (CVSS 9.3): Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information…