CVE-2020-4095: hcltech bigfix_platform
Vulnerability summary
CVE-2020-4095 is a medium (CVSS 6.0) vulnerability in hcltech bigfix_platform. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 8.6% of scored vulnerabilities.
Timeline
- 16-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
"BigFix Platform is storing clear text credentials within the system's memory. An attacker who is able to gain administrative privileges can use a program to create a memory dump and extract the credentials. These credentials can be used to pivot further into the environment. The principle of least privilege should be applied to all BigFix deployments, limiting administrative access."
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
9%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
Affected systems
Hcltech1 product
- bigfix_platform≥ 9.2, ≤ 9.2.19 | ≥ 9.5, ≤ 9.5.15
1 vendor · 1 product