CVE-2022-38658
HCL BigFix Server Automation (SA) is affected by a security vulnerability around Notification Service
- State
- Published
- Severity
- 7.7 High
- Published
- Dec 22, 2022
- Updated
- Apr 15, 2025
- Reserved
- Aug 22, 2022
Description
BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.7 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:H | HCL |
Weaknesses
- CWE-311 Missing Encryption of Sensitive Data
Affected Products
| Product | Versions |
|---|---|
BigFix Server AutomationHCL Software |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.