CVE-2020-14254 — Use of a Broken or Risky Cryptographic Algorithm in Bigfix Platform

CWE-327 — Use of a Broken or Risky Cryptographic AlgorithmCWE-311 — Missing Encryption of Sensitive Data3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 64.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Hcltech Bigfix PlatformHCL Software HCL Bigfix Inventory
Timeline
PublishedDec 16
Latest updateMay 24

Description

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5hcl_software/hcl_bigfix_inventoryv9.x, v10.x

Patches

Patch: support.hcltechsw.com ↗Patch: support.hcltechsw.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-wfwq-hhcq-h62r: TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10↗2022-05-24
▶
CVEList
CVE-2020-14254: TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10↗2020-12-16
▶
CVE-2020-14254 — Hcltech Bigfix Platform vulnerability | cvebase