CVE-2023-37523 is a medium severity (CVSS 5.6) cross-site scripting flaw in the HCL BigFix Bare OSD Metal Server WebUI, version 311.19 or lower. Missing or insecure tags could let an attacker run a script in a user's browser. Check HCL's bulletin for the fix.
What's affected
The NVD record says the WebUI of the HCL BigFix Bare OSD Metal Server, version 311.19 or lower, has missing or insecure tags that could let an attacker execute a malicious script in the user's browser. The weakness is CWE-79 (cross-site scripting). The CPE name in the record is the WebUI product.
HCL's bulletin KB0109754 is titled as covering multiple security vulnerabilities in the Bare Metal Server WebUI. I could not read its text in this review, since the page needs a browser, so I am not giving a fixed version. Read the bulletin for that. A related record, CVE-2023-37522, has near identical wording, so expect both to be covered in the same bulletin.
How to check if you're exposed
- Find the OS deployment server in your BigFix estate and open its WebUI to read the version.
- If it reads 311.19 or lower, you are in the range named by the record.
- Check who can reach the WebUI. A browser based flaw matters most where many people sign in, or where staff open links from outside.
- Read KB0109754 for the version that fixes it.
What to do now
- Apply the update HCL describes in KB0109754.
- Keep the WebUI off the internet and available only from admin networks.
- Ask administrators to open the WebUI from a dedicated browser profile and to avoid following unknown links while signed in.
- Add the product and its version to your inventory.
Why it matters
Cross-site scripting happens when a page includes data it should have escaped or marked up safely, and a script from an attacker runs in the victim's browser as if it came from the site. Here the record points to missing or insecure tags. The vector has high attack complexity and no privileges required, which explains the medium score of 5.6.
The impact depends on who signs in. A deployment server tied to operating system provisioning is used by administrators, so a script that runs in their session is more serious than the base score suggests. The record does not mark this CVE as known exploited. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Is CVE-2023-37522 the same issue?
Both records describe the same WebUI and the same kind of flaw in almost the same words. Treat them together and use HCL's bulletin to see how each is addressed.
Sources
Last reviewed: 19 October 2026.
