CVE-2024-30142
Last modified
CVE-2024-30142 is a low-severity vulnerability rated 3.8/10 on the CVSS scale. HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.. EPSS estimates a 0.10% chance of exploitation in the next 30 days.
Description
HCL BigFix Compliance is affected by a missing secure flag on a cookie. If a secure flag is not set, cookies may be stolen by an attacker using XSS, resulting in unauthorized access or session cookies could be transferred over an unencrypted channel.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hcltech | Bigfix Compliance | 2.0.11 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-30142?
How severe is CVE-2024-30142?
How do I fix CVE-2024-30142?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-30133HCL Traveler for Microsoft Outlook (HTMO) is susceptible to …5.3
- CVE-2024-30134The HCL Traveler for Microsoft Outlook executable (HTMO.exe)…7.5
- CVE-2024-30135HCL DRYiCE AEX is potentially impacted by disclosure of sens…7.5
- CVE-2024-3014A vulnerability classified as critical has been found in Sou…8.8
- CVE-2024-30140HCL BigFix Compliance is affected by unvalidated redirects a…5.4
- CVE-2024-30141HCL BigFix Compliance is vulnerable to the generation of err…4.7
- CVE-2024-30143HCL AppScan Traffic Recorder fails to adequately neutralize …4.3
- CVE-2024-30145Multiple vectors in HCL Domino Volt and Domino Leap allow cl…6.1
- CVE-2024-30146Improper access control of endpoint in HCL Domino Leap allow…2.7
- CVE-2024-30147Multiple vectors in HCL Leap allow client-side script inject…6.1
- CVE-2024-30148Improper access control of endpoint in HCL Leap allows certa…4.1
- CVE-2024-30149HCL AppScan Source <= 10.6.0 does not properly validate a TL…6.5
Are you affected by CVE-2024-30142?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST