Medium severity · published May 7, 2024
CVE-2024-23551
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
BigFix Compliance · HCL Software
v9.x, v10.x, v11.x · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-23551
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-23551
support.hcltechsw.com
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112963
More from BigFix Compliance
6.2
CVE-2024-30125
HCL BigFix Compliance is affected by an internal server error
5.4
CVE-2024-30140
HCL BigFix Compliance is affected by unvalidated redirects and forwards
4.7
CVE-2024-30141
HCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive information
4.7
CVE-2024-30126
HCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerability
3.8
CVE-2024-30142
HCL BigFix Compliance is affected by a missing secure flag on a cookie