High severity · published May 12, 2022
CVE-2021-27777
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unica · Hcltech
before 12.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27777
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097124
More from Unica
9.8
CVE-2025-62319
Boolean-Based SQL Injection in Multiple Unica Components
8.8
CVE-2023-37498
A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator
8.8
CVE-2023-37497
The Unica application exposes an API which accepts arbitrary XML input
7.5
CVE-2025-51735
CSV formula injection vulnerability in HCL Technologies Ltd
7.5
CVE-2025-31996
Unprotected files are impacting HCL Unica Platform