Vulnerability · Published Jul 16, 2020 · Assigned by HCL
CVE-2020-4095
Medium 6.0
In plain English
A medium-severity security flaw in "HCL BigFix Platform". There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Severity (CVSS NVD)6.0Medium
Exploit odds (30 days)0.2%top 90.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | "HCL BigFix Platform" | "v9.2 - 9.2.19, v9.5 - 9.5.15" |