The use of an outdated and unsupported jQuery library in HCL BigFix SCM Reporting 11.0.5 introduces significant security risks due to unpatched vulnerabilities in the legacy component.

This is a supply chain/dependency vulnerability (CWE-1104) where an unmaintained third-party component (jQuery 1.x) is included in the software. This can lead to various client-side attacks, including Cross-Site Scripting (XSS), depending on how the application implements the library.

The CVSS score of 8.3 indicates a High severity level. The use of legacy components often serves as a primary vector for attackers to bypass existing security controls. Compromise of the SCM Reporting interface could lead to unauthorized access to sensitive security configuration data and potentially facilitate broader exploitation of the BigFix management ecosystem.

Immediate Action: Consult the HCL support portal for the latest security patches or guidance on upgrading the BigFix SCM Reporting component to a version that utilizes a supported, secure jQuery library.

Proactive Monitoring: Inspect web traffic to the SCM Reporting site for evidence of exploit attempts targeting known jQuery vulnerabilities, such as malformed query parameters.

Compensating Controls: Utilize a Web Application Firewall (WAF) with updated rulesets to detect and block common XSS or JavaScript injection payloads that might target the outdated jQuery library.

Public Exploit Available: No

Outdated dependencies are a common target for attackers. Administrators should prioritize upgrading to the latest version of HCL BigFix SCM Reporting to replace the unsupported jQuery library and reduce the risk of exploitation.