CVE-2021-27759

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was sent intentionally. An attacker can cause a victim's browser to emit an HTTP request to an arbitrary URL in the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352 CWE-345

Affected software

No affected versions have been published.

Timeline

Published: May 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277605.5An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause CVE-2021-277617.5Weak web transport security (Weak TLS): An attacker may be able to decrypt the data using attacks CVE-2021-277629.8Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses CVE-2021-277646.5Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing fla CVE-2021-277657.8The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a loca CVE-2021-277667.8The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local us CVE-2021-277677.8The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local u CVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informati CVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may CVE-2021-277708.8The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserve CVE-2021-277717.6User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a CVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start g