CVE-2022-37177

Published Aug 29, 2022

Last updated 3 months ago

Overview

Description: HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence cipher has been removed, and TLS 1.2 is now used for encryption.
Source: cve@mitre.org
NVD status: Modified
CNA Tags: disputed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-327

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:hirevue:hiring_platform:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DFF5DE58-5847-46E0-B56F-7CF9C308122B"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References