In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
Weakness
The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bigfix_platform | Hcltech | 9.5 (including) | 9.5.20 (including) |
| Bigfix_platform | Hcltech | 10 (including) | 10.0.7 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/112.html
- https://cwe.mitre.org/data/definitions/192.html
- https://cwe.mitre.org/data/definitions/20.html
References
- https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0102049
- https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0102049