What’s Vulnerable › Vulnerabilities

CVE-2020-4099: HCL Verse for Android is susceptible to an APK signing key check vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-11-01 · updated 2026-06-17
• Weakness: CWE-326

Description

The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.

Affected products

• HCL Software HCL Verse: before 12.0.15 — fixed in 12.0.15

How to fix

Upgrade to a fixed version: HCL Software HCL Verse 12.0.15. Check the vendor advisory for mitigations.

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861

Get alerted when CVE-2020-4099 or the next vulnerability affects your stack