How severe is CVE-2020-4100?

CVE-2020-4100 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2020-4100 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-4100?

CVE-2020-4100 affects Hcltechsw Hcl Verse. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-4100?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-4100 published?

CVE-2020-4100 was published on 2020-07-15 and last updated on 2026-06-17.

CVE-2020-4100

CVE-2020-4100 is a medium-severity vulnerability in Hcltechsw Hcl Verse with a CVSS 3.x base score of 4.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-913.

Key facts

Severity: Medium (CVSS 3.x base score 4.4)
CVSS v2: 2.1
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-913
Affected product: Hcltechsw Hcl Verse
Published: 2020-07-15
Last modified: 2026-06-17

Description

"HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime; however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (for example, a non-invasive update feature), it can also open the application to loading unintended code if not implemented properly."

Frequently asked questions

What is CVE-2020-4100?: "HCL Verse for Android was found to employ dynamic code loading. This mechanism allows a developer to specify which components of the application should not be loaded by default when the application is started. Typically, core components and additional dependencies are loaded natively at runtime; however, dynamically loaded components are only loaded as they are specifically requested. While this can have a positive impact on performance, or grant additional functionality (for example, a non-invasive update feature), it can also open the application to loading unintended code if not implemented properly."
How severe is CVE-2020-4100?: CVE-2020-4100 has a CVSS 3.x base score of 4.4, rated medium severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2020-4100 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-4100?: CVE-2020-4100 affects Hcltechsw Hcl Verse. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-4100?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-4100 published?: CVE-2020-4100 was published on 2020-07-15 and last updated on 2026-06-17.

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0080800

Affected products (1)

cpe:2.3:a:hcltechsw:hcl_verse:11.0.4:*:*:*:*:android:*:*

Other CWE-913 vulnerabilities

CVE-2026-47208 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout…
CVE-2026-47137 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903)…
CVE-2026-47131 — Critical (CVSS 10.0): vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining…
CVE-2023-29017 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was…
CVE-2022-36067 — Critical (CVSS 10.0): vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version…
CVE-2026-34156 — Critical (CVSS 9.9): NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior…

Browse all CWE-913 vulnerabilities →