CVE-2021-27756

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

Vendor	Product	Versions
n/a	"BigFix Compliance Server"	"BigFix Compliance Server 2.0 - 2.0.5"

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977Mitigation, Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977Mitigation, Vendor Advisory

Timeline

Published: Mar 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277577.5" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to an CVE-2021-277586.5There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to lo CVE-2021-277596.5This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was se CVE-2021-277605.5An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause CVE-2021-277617.5Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks CVE-2021-277629.8Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses CVE-2021-277646.5Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing fla CVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a loca CVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local us CVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local u CVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informati CVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may