Medium severity · published May 6, 2022
CVE-2021-27759
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
Bigfix Inventory · Hcltech
9.0 before 10.0.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27759
Mitigation
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098006
More from Bigfix Inventory
6.5
CVE-2021-27758
There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to login and system blocked victim's account
5.3
CVE-2024-23540
HCL BigFix Inventory is vulnerable to path traversal