PT-2021-9704 · Hcl · Hcl Onetest Performance

Published 2021-02-04 · Updated 2021-07-21 · CVE-2020-14246

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HCL OneTest Performance versions 9.5 through 10.1

Description The issue is related to the use of basic authentication in HCL OneTest Performance, which is considered relatively weak. An attacker could potentially decode the encoded credentials.

Recommendations For versions 9.5 through 10.1, consider disabling basic authentication until a more secure method is implemented. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using basic authentication for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2020-14246

Affected Products

Hcl Onetest Performance

References · 5

• https://osv.dev/vulnerability/CVE-2020-14246 · Vendor Advisory
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14246 · Security Note
• https://t.me/cvenotify/9404 · Telegram Post
• https://t.me/cibsecurity/23051 · Telegram Post