CVE-2020-4092 Information disclosure in "HCL Nomad"
HCL Nomad mobile apps transmit sensitive data in clear text if server port encryption is disabled, exposing user IDs and documents to attackers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4092?
CVE-2020-4092 is a medium-severity vulnerability in "HCL Nomad", published on 6 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."
Weakness: CWE-319
Which versions are affected by CVE-2020-4092?
It affects 1 product.
Products include Hcltech Hcl Nomad.
How do I fix CVE-2020-4092?
No fix has been published for CVE-2020-4092 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4092 being exploited?
There is no known exploitation of CVE-2020-4092 in the wild and no public exploit code.
Other vulnerabilities in "HCL Nomad"
Sources
Also known as GHSA-fc6g-9746-9j7g.