HCL BigFix OSD Bare Metal Server is affected by a host header injection vulnerability
Priority LOW 27CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Host Header Injection vulnerability in the HCL BigFix OSD Bare Metal Server version 311.12 or lower allows attacker to supply invalid input to cause the OSD Bare Metal Server to perform a redirect to an attacker-controlled domain.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed HCL BigFix OSD Bare Metal Server (HCL Software): 311.12
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HCL Software | HCL BigFix OSD Bare Metal Server | before 311.12 | 311.12 | Patch available | CNA |
- HCL BigFix OSD Bare Metal Server VendorHCL Software Affected before 311.12 Fixed in 311.12 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hcltech:bigfix_osd_bare_metal_server:*:*:*:*:*:*:*:* | up to 311.12 | Vulnerable | HCL Software |
- cpe:2.3:a:hcltech:bigfix_osd_bare_metal_server:*:*:*:*:*:*:*:* Versions up to 311.12 Vulnerable ·HCL Software
Remediation
- Fix · CNA HCL BigFix OSD Bare Metal Server (HCL Software) Fixed in 311.12
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28016
- 2026-10-03 Alias added: GHSA-hcrr-5fhg-v2r7
References
More HCL Software Bigfix Osd Bare Metal Server vulnerabilities
- TI-2023-12594 HCL BigFix OSD Bare Metal Server is affected by a weak cryptographic algorithm. CVSS 3.1HIGH 7.8
- TI-2023-09198 HCL BigFix OSD Bare Metal Server version 311.12 or lower is affected by a clickjacking vulnerability. CVSS 3.1MEDIUM 6.1
Sources
- CVE-2023-28016 · CVE Program
- CVE-2023-28016 · NVD
- FIRST EPSS
- GHSA-hcrr-5fhg-v2r7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences