Medium severity · published Jul 16, 2020
CVE-2020-4095
"BigFix Platform is storing clear text credentials within the system's memory
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BP
Bigfix Platform · Hcltech
9.2 through 9.2.19; 9.5 through 9.5.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-4095
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-4095
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080772
More from Bigfix Platform
9.8
CVE-2021-27762
Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses
8.8
CVE-2024-23554
Cross-Site Request Forgery (CSRF) on Session Token vulnerability that could potentially lead to Remote Code Execution (RCE)
8.8
CVE-2023-37536
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request
8.1
CVE-2024-42193
HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in its handling of SSL certificate validation
7.8
CVE-2026-21765
HCL BigFix Platform is affected by insecure permissions on private cryptographic keys