CVE-2021-27786: hcl software hcl onetest server
Vulnerability summary
CVE-2021-27786 is a critical (CVSS 9.8) vulnerability in hcl software hcl onetest server. EPSS estimates a 0.58% chance of exploitation in the next 30 days, higher than 46.8% of scored vulnerabilities.
Timeline
- 07-06-2022PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA4.6MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.58%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
+0.01 pp
From 0.57% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsThe product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
- CWE-697Incorrect ComparisonThe product compares two entities in a security-relevant context, but the comparison is incorrect.
Affected systems
Hcl software1 product
- hcl onetest server10.0, 10.1, 10.2
Hcltech1 product
- onetest_server10.0 | 10.1 | 10.2
2 vendors · 2 products