CVE-2020-4099 HCL Verse for Android is susceptible to an APK signing key check vulnerability
Attackers can forge digital signatures to distribute maliciously modified versions of the HCL Verse Android application due to weak signing keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-4099?
CVE-2020-4099 is a medium-severity vulnerability in HCL Verse for Android, published on 1 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
Weakness: CWE-326
Which versions are affected by CVE-2020-4099?
It affects 1 product.
Products include Hcltech Verse.
How do I fix CVE-2020-4099?
No fix has been published for CVE-2020-4099 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-4099 being exploited?
There is no known exploitation of CVE-2020-4099 in the wild and no public exploit code.
Other vulnerabilities in HCL Verse for Android
- CVE-2023-37496 HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability
- CVE-2021-27788 HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability
- CVE-2023-28013 HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability
- CVE-2021-27768 An SSL certificate host verification vulnerability affects HCL Verse for Android
Sources
Also known as GHSA-pc4m-vcwh-9c5h.