CVE-2024-23551: medium-severity vulnerability in HCL Software BigFix Compliance
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
HCL Software · BigFix ComplianceRelated CVEs — HCL Software BigFix Compliance
In the same product, most dangerous first.
CVE-2024-30141MEDIUMHCL BigFix Compliance is vulnerable to the generation of error messages containing sensitive informationEPSS 0.3%CVE-2024-30140MEDIUMHCL BigFix Compliance is affected by unvalidated redirects and forwardsEPSS 0.3%CVE-2024-30126MEDIUMHCL BigFix Compliance is affected by a missing X-Frame-Options Header vulnerabilityEPSS 0.2%CVE-2024-30125MEDIUMHCL BigFix Compliance is affected by an internal server errorEPSS 0.1%CVE-2024-30142LOWHCL BigFix Compliance is affected by a missing secure flag on a cookieEPSS 0.1%