title: HCL Verse for Android is susceptible to an APK signing key check vulnerability
description: The application was signed using a key length less than or equal to 1024 bits, making it potentially vulnerable to forged digital signatures. An attacker could forge the same digital signature of the app after maliciously modifying the app.
problem types: CWE-326 Inadequate Encryption Strength
affected:
{
vendor: HCL Software
product: HCL Verse for Android
versions:
version: < 12.0.15, status: affected
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
]