CVE-2020-4099 - HCL Verse for Android is susceptible to an APK signing key check vulnerability

Back Back to CVE browser

HIGH

HCL Verse for Android is susceptible to an APK signing key check vulnerability

Published Nov 1, 2022

7.5

HIGH

CVSS 3.1

EPSS 0.29%

Description

The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.

Affected products

Vendor HCL Software Product HCL Verse for Android Default
n/a
- Version
  < 12.0.15
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HCL Software

HCL Verse for Android

n/a

Version	Status	Constraints
< 12.0.15	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-326

Inadequate Encryption Strength

References (1)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861
Vendor Advisory

Link	Providers	Tags
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100861		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner HCL

Published Nov 1, 2022

Updated May 2, 2025

Reserved Dec 30, 2019

Link CVE-2020-4099

CISA Vulnrichment

Updated May 2, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-4099

Red Hat

Severity n/a

Public date n/a

Links CVE-2020-4099