Medium severity · published May 6, 2020
CVE-2020-4092
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option…
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HN
Hcl Nomad · Hcltech
1.0; 1.0; 1.0.1; 1.0.1; 1.0.2; 1.0.2; +9 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4092
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4092
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0078969
More from Hcl Nomad
7.5
CVE-2024-23586
An insufficient session timeout vulnerability affects HCL Nomad server on Domino
7.1
CVE-2023-23342
If certain local files are manipulated in a certain manner, the validation to use the cryptographic keys can be circumvented
5.3
CVE-2024-30129
HCL Nomad server on Domino is affected by a host header injection vulnerability