Static Encryption Key Vulnerability in BMC PATROL Agent
CVE-2019-8352

9.8CRITICAL

Key Information:

Vendor

Bmc

Status
Patrol Agent
Vendor
CVE Published:
20 May 2019

What is CVE-2019-8352?

The BMC PATROL Agent, up to version 11.3.01, employs a static encryption key for the encryption and decryption of user credentials transmitted over the network. This practice exposes the system to significant risks, as an attacker who manages to intercept the network traffic can decrypt these credentials. By gaining access to the user credentials, the attacker could potentially execute unauthorized code or elevate privileges within the network, compromising security and integrity.

References

https://www.securifera.com/advisories/CVE-2019-8352/
x_refsource_MISC

EPSS Score

6% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.