Hcl · Hcl Bigfix Compliance · CVE-2024-23551
**Name of the Vulnerable Software and Affected Versions**
HCL BigFix Compliance versions 9.x through 11.x
**Description**
Database scanning using a `username` and `password` stores the credentials in plaintext or encoded format within files at the endpoint. This has been identified as a significant security risk, leading to exposure of sensitive information for unauthorized access, potentially resulting in severe consequences such as data breaches, unauthorized data manipulation, and compromised system integrity.
**Recommendations**
For versions 9.x through 11.x, consider disabling database scanning using username and password until a patch is available. Restrict access to sensitive files at the endpoint to minimize the risk of exploitation. Avoid using plaintext or encoded format for storing credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.