CVE Vulnerability

CVE-2020-14254

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0085733 Patch Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:hcltech:bigfix_platform:*:*:*:*:*:*:*:*
Information

Published : 2020-12-16 03:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-14254

Mitre link : CVE-2020-14254

Products Affected
No products.
CWE
CWE-1240

Use of a Cryptographic Primitive with a Risky Implementation