Skip to main content

Improper Neutralization of Encoded URI Schemes in a Web Page

CVE-2024-42184

Low
2.5/10

Summary

BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operator to attempt to download files using the file:// URI scheme.

  • HIGH
  • LOCAL
  • NONE
  • CHANGED
  • REQUIRED
  • LOW
  • LOW
  • NONE

CWE-84 - Improper Neutralization of Encoded URI Schemes in a Web Page

The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.

References

Advisory Timeline

  • Published