CVE-2021-27781 - Vulnerability Details - OpenCVE

The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Hcltech	Bigfix Mobile Modern Client Management

Configuration 1 [-]

OR	cpe:2.3:a:hcltech:bigfix_mobile::::::::
	cpe:2.3:a:hcltech:modern_client_management::::::::

No data.

References

Link	Providers
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028

History

Mon, 16 Sep 2024 23:30:00 +0000

Type	Values Removed	Values Added
Title	HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting	HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting

MITRE

Status: PUBLISHED

Assigner: HCL

Published: 2022-05-27T16:15:16.664653Z

Updated: 2024-09-16T23:21:37.184Z

Reserved: 2021-02-26T00:00:00

Link: CVE-2021-27781

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-27T17:15:07.770

Modified: 2024-11-21T05:58:33.233

Link: CVE-2021-27781

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "HCL BigFix Mobile / Modern Client Management", "vendor": "HCL Software", "versions": [{"status": "affected", "version": "2.0"}]}], "datePublic": "2022-05-09T00:00:00", "descriptions": [{"lang": "en", "value": "The Master operator may be able to embed script tag in HTML with alert pop-up display cookie."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-27T16:15:16", "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028"}], "source": {"discovery": "UNKNOWN"}, "title": "HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@hcl.com", "DATE_PUBLIC": "2022-05-09T00:00:00.000Z", "ID": "CVE-2021-27781", "STATE": "PUBLIC", "TITLE": "HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "HCL BigFix Mobile / Modern Client Management", "version": {"version_data": [{"version_value": "2.0"}]}}]}, "vendor_name": "HCL Software"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Master operator may be able to embed script tag in HTML with alert pop-up display cookie."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028", "refsource": "MISC", "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T21:33:15.792Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028"}]}]}, "cveMetadata": {"assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "assignerShortName": "HCL", "cveId": "CVE-2021-27781", "datePublished": "2022-05-27T16:15:16.664653Z", "dateReserved": "2021-02-26T00:00:00", "dateUpdated": "2024-09-16T23:21:37.184Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:bigfix_mobile:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA3DEFDE-3119-4DE2-98C4-8FA1AC65B81C", "versionEndExcluding": "2.1", "versionStartIncluding": "1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:modern_client_management:*:*:*:*:*:*:*:*", "matchCriteriaId": "254F8C6D-44D7-4E04-8CE0-C4D793EEAAC0", "versionEndExcluding": "2.1", "versionStartIncluding": "1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Master operator may be able to embed script tag in HTML with alert pop-up display cookie."}, {"lang": "es", "value": "El operador de Master puede ser capaz de insertar la etiqueta de script en HTML con la cookie de visualizaci\u00f3n de alertas"}], "id": "CVE-2021-27781", "lastModified": "2024-11-21T05:58:33.233", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 3.7, "source": "psirt@hcl.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-27T17:15:07.770", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098028"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@hcl.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}