CVE-2021-27759: hcl software hcl bigfix inventory Cross-Site Request Forgery (CSRF)
CVSS: 6.5v3.1MediumModified
Published 06-05-2022Last modified 17-09-2024
Vulnerability summary
CVE-2021-27759 is a medium (CVSS 6.5) Cross-Site Request Forgery (CSRF) vulnerability in hcl software hcl bigfix inventory. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.2% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 06-05-2022PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSources2 sources · 2.3–6.5
- CVE.orgCNA2.3LowCVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:F/RL:U/RC:C/CR:L/IR:L/AR:L/MAV:A/MAC:H/MPR:L/MUI:R/MS:U/MC:X/MI:N/MA:NDiffers
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
21%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 18-09-2026
18-09-202618-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
- CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Affected systems
Hcl software1 product
- hcl bigfix inventory≥ 9.0, < 10.0 | ≥ 10.0, < 11.0
Hcltech1 product
- bigfix_inventory≥ 9.0, < 10.0.7.0
2 vendors · 2 products
References
1 links- support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006X Refsource MISCMitigationVendor Advisory