CVE-2020-14254 Weak cryptography in HCL BigFix Inventory
Attackers can decrypt recorded traffic if TLS-RSA ciphers are enabled and secure ciphers are not configured in HCL BigFix Inventory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14254?
CVE-2020-14254 is a high-severity vulnerability in HCL BigFix Inventory, published on 16 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it.
Weakness: CWE-327
Which versions are affected by CVE-2020-14254?
It affects 1 product.
Products include Hcltech Bigfix Platform.
How do I fix CVE-2020-14254?
No fix has been published for CVE-2020-14254 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-14254 being exploited?
There is no known exploitation of CVE-2020-14254 in the wild and no public exploit code.
Other vulnerabilities in HCL BigFix Inventory
- CVE-2026-21765 HCL BigFix Platform is affected by insecure permissions on private cryptographic keys
- CVE-2023-37519 HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
- CVE-2023-37520 HCL BigFix Platform is affected by Unathenticated Stored Cross-Site Scripting (XSS)
- CVE-2022-42453 HCL BigFix Platform is affected by insufficient warnings
- CVE-2024-23583 HCL BigFix Platform is susceptible to insufficiently protected credentials
Sources
Also known as GHSA-wfwq-hhcq-h62r.