CVE-2021-27767

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
HCL Software	BigFix Platform	9.5 - 9.5.18, 10 - 10.0.5

References

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0025/MNDT-2022-0025.mdThird Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116Vendor Advisory
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0025/MNDT-2022-0025.mdThird Party Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098116Vendor Advisory

Timeline

Published: May 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277685.9Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account informati CVE-2021-277695.3Information leakage occurs when a website reveals information that could aid an attacker to further exploit the system. This information may CVE-2021-277708.8The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserve CVE-2021-277717.6User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a CVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start g CVE-2021-277734.3This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-277745.4User input included in error response, which could be used in a phishing attack.CVE-2021-277777.5XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient CVE-2021-277784.8HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in CVE-2021-277799.1VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with th CVE-2021-277805.3The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-277814.8The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.