CVE-2023-37518 is a medium severity (CVSS 6.4) code injection flaw in HCL BigFix ServiceNow Data Flow. An authorized attacker could inject code that runs as the user the component runs under. HCL publishes a security bulletin, so check it for the fixed version and apply it.
What's affected
The NVD record names HCL BigFix ServiceNow Data Flow and says it is vulnerable to arbitrary code injection. It does not list affected versions. HCL's bulletin is the place to find them. I could not read the bulletin text in this review, because the support page needs a browser to render, so I am not stating a fixed version. Open KB0110202 and read the affected and fixed builds before you plan.
The weakness is CWE-94 (improper control of generation of code, or code injection). The score is 6.4, medium, with network access, low complexity, low privileges, no user interaction and a changed scope. The attacker must be authorized, according to the record.
How to check if you're exposed
- Find out whether the BigFix ServiceNow Data Flow component is installed.
- Read the component version on the server where it runs, using the BigFix console or the product documentation.
- Compare that version with the affected and fixed versions in the HCL bulletin KB0110202.
- List the accounts that can configure or use the component, since the record requires an authorized attacker.
What to do now
- Read HCL bulletin KB0110202 and apply the update or mitigation it describes.
- Limit who can configure the Data Flow component to the people who need it, and remove unused accounts.
- Review the rights of the service account the component runs under. The record says injected code runs in the context of that user, so less privilege means less damage.
- Record the component in your inventory with its version so later notices are easy to match.
Why it matters
Code injection means text supplied by a user ends up being interpreted as code by the application. The attacker needs an authorized account, and the score is medium for that reason. The changed scope in the vector is worth noticing, though. It says the impact can reach beyond the vulnerable component, which is plausible for a tool that sits between two management systems.
Medium scores tend to sink down the backlog. For integration components, ask what the service account can reach before you decide it can wait. The record does not mark this CVE as known exploited. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Do I need to be an attacker with admin rights?
The record says a malicious authorized attacker, with low privileges in the vector. It does not require administrator rights, which is why the access list for the component matters.
Sources
Last reviewed: 19 October 2026.
