CVE-2024-23551: hcl software bigfix compliance Insufficiently Protected Credentials

Vulnerability summary

CVE-2024-23551 is a medium (CVSS 6.5) Insufficiently Protected Credentials vulnerability in hcl software bigfix compliance. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6% of scored vulnerabilities.

Timeline

1. 07-05-2024
   PublishedVulnerability first disclosed.
2. 01-08-2024
   Last modifiedVulnerability information updated.

Description

Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.

• CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.