CVE-2021-27778

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

CVSS v3 4.9 MEDIUM
CVSS v2.0 3.5 LOW

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044	Third Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:traveler:*:*:*:*:*:*:*:*

History

21 Nov 2024, 05:58

Type	Values Removed	Values Added
CVSS	v2 : ~~3.5~~ v3 : ~~4.8~~	v2 : 3.5 v3 : 4.9
References	~~() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044 - Third Party Advisory~~	() https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044 - Third Party Advisory

Information

Published : 2022-06-01 00:15

Updated : 2024-11-21 05:58

NVD link : CVE-2021-27778

Mitre link : CVE-2021-27778

CVE.ORG link : CVE-2021-27778

JSON object : View

Products Affected

hcltech

traveler

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2021-27778", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2022-06-01T00:15:07.690", "references": [{"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044", "tags": ["Third Party Advisory"], "source": "psirt@hcl.com"}, {"url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098044", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site."}, {"lang": "es", "value": "HCL Traveler es vulnerable a un cross-site scripting (XSS) causado por una validaci\u00f3n inadecuada del par\u00e1metro Name para Approved Applications en las p\u00e1ginas web de administraci\u00f3n de Traveler. Un atacante podr\u00eda explotar esta vulnerabilidad para ejecutar un script malicioso para acceder a cualquier cookie, tokens de sesi\u00f3n u otra informaci\u00f3n sensible retenida por el navegador y utilizada con ese sitio"}], "lastModified": "2024-11-21T05:58:32.840", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:traveler:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FDCA909-C9B2-4B3E-AB24-4C351BBD8681", "versionEndIncluding": "12.0.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}