PT-2024-19934 · Hcl · Hcl Bigfix Compliance

Gina Wong-Moe + 1 · Published 2024-05-07 · Updated 2024-05-08 · CVE-2024-23551

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HCL BigFix Compliance versions 9.x through 11.x

Description Database scanning using a username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk, leading to exposure of sensitive information for unauthorized access, potentially resulting in severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.

Recommendations For versions 9.x through 11.x, consider disabling database scanning using username and password until a patch is available. Restrict access to sensitive files at the endpoint to minimize the risk of exploitation. Avoid using plaintext or encoded format for storing credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-23551

Affected Products

Hcl Bigfix Compliance

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-23551 · Security Note
• https://t.me/cvenotify/79502 · Telegram Post
• https://twitter.com/CVEnew/status/1788295977100779622 · Twitter Post
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112963 · Note
• https://twitter.com/micsieg/status/1787989877193076782 · Twitter Post