CVE Vulnerabilities

CVE-2022-38659

Inadequate Encryption Strength

Published: Dec 19, 2022 | Modified: Nov 07, 2023
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.

Weakness

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Affected Software

Name Vendor Start Version End Version
Bigfix_platform Hcltech 9.5 (including) 9.5.20 (including)
Bigfix_platform Hcltech 10 (including) 10.0.7 (including)

Potential Mitigations

References