CVE-2022-38658

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
HCL Software	BigFix Server Automation	<=3.2.1

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102117Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0102117Vendor Advisory

Timeline

Published: Dec 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-386597.8In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.CVE-2022-38664.3HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that b CVE-2022-386608.8HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit thi CVE-2022-386617.1HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.CVE-2022-386626.1In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.CVE-2022-386636.5Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git CVE-2022-386645.4Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History pag CVE-2022-386656.5Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins co CVE-2022-386667.5Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname valid CVE-2022-386679.8HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP CVE-2022-386687.5HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfillin CVE-2022-386697.8In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additio