What’s Vulnerable › Vulnerabilities
CVE-2024-23551: HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-07 · updated 2026-06-17
- Weakness: CWE-522
Description
Database scanning using username and password stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk. This will lead to exposure of sensitive information for unauthorized access, potentially leading to severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.
Affected products
- HCL Software BigFix Compliance: from 9.0.835.0 through 9.5.25.11; from 10.0.0.133 through 10.0.5.0; from 11.0.0.175 through 11.0.2.125
References
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112963
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0112963
Get alerted when CVE-2024-23551 or the next vulnerability affects your stack