Vulnerability in Bmc Patrol Agent
CVE-2019-8352
By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network.
EPSS: 0.063 (92.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Bmc Patrol_agent
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2019-8352?
- CVE-2019-8352 is a critical-severity vulnerability in Bmc Patrol Agent, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2019-05-20.
- How severe is CVE-2019-8352?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-8352 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.