CVE-2019-8352
If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.28%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 6.28% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- bmc/patrol agent
- Source
- cve@mitre.org
References
- https://www.securifera.com/advisories/CVE-2019-8352/Third Party Advisory
- https://www.securifera.com/advisories/CVE-2019-8352/Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.