CVEvulnerability

CVE-2020-4095

6.0 MEDIUM Published 2020-07-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-07-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.0 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-312, CWE-522

Description

"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."

Affected configurations

• hcltech bigfix platform (>= 9.2 <= 9.2.19) • hcltech bigfix platform (>= 9.5 <= 9.5.15)

Related

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References