Lucene search

HCLCVE-2024-23551

HistoryMay 07, 2024 - 10:15 p.m.

CVE-2024-23551

2024-05-0722:15:07

CWE-522

HCL

web.nvd.nist.gov

database scanning

plaintext credentials

encoded credentials

security risk

sensitive information

unauthorized access

data breaches

data manipulation

compromised integrity

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.0%

JSON

Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "BigFix Compliance",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "v9.x, v10.x, v11.x"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112963

CVSS3

6.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

Low

EPSS

Percentile

9.0%

JSON

Related for CVE-2024-23551