Low severity · published May 6, 2022
CVE-2021-27751
HCL Commerce is affected by an Insufficient Session Expiration vulnerability
3.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the application are still accessible.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HC
Hcl Commerce · Hcltechsw
8.0.0.0 before 8.0.4.28; 9.0.0.0 before 9.0.1.18; 9.1.0 before 9.1.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27751
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27751
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097650
More from Hcl Commerce
9.8
CVE-2022-38656
HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes
9.8
CVE-2020-14275
Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could allow denial of service, disclosure of user personal data,…
9.1
CVE-2021-27741
" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
7.5
CVE-2020-14274
Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a remote attacker to obtain user personal data via unknown vectors
7.1
CVE-2024-23576
HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability