CVE-2021-27759
Last modified
CVE-2021-27759 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.. EPSS estimates a 0.27% chance of exploitation in the next 30 days.
Description
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hcltech | Bigfix Inventory | >= 9.0, < 10.0.7.0 |
References
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006Mitigation, Vendor Advisory
- https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-27759?
How severe is CVE-2021-27759?
How do I fix CVE-2021-27759?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-27751HCL Commerce is affected by an Insufficient Session Expirati…3.3
- CVE-2021-27753"Sametime Android PathTraversal Vulnerability"5.5
- CVE-2021-27755"Sametime Android potential path traversal vulnerability whe…5.5
- CVE-2021-27756"TLS-RSA cipher suites are not disabled in BigFix Compliance…7.5
- CVE-2021-27757" Insecure password storage issue.The application stores sen…7.5
- CVE-2021-27758There is a security vulnerability in login form related to C…6.5
- CVE-2021-27760An issue was discovered in the Sametime chat feature in the …5.5
- CVE-2021-27761Weak web transport security (Weak TLS): An attacker may be a…7.5
- CVE-2021-27762Misconfigured security-related HTTP headers: Several securit…9.8
- CVE-2021-27764Cookie without HTTPONLY flag set. NUMBER cookie(s) was set w…6.5
- CVE-2021-27765The BigFix Server API installer is created with InstallShiel…7.8
- CVE-2021-27766The BigFix Client installer is created with InstallShield, w…7.8
Are you affected by CVE-2021-27759?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST