CVE-2021-27764 HCL BigFix WebUI Cookie missing attributes
Attackers can steal session cookies via XSS or network sniffing because the WebUI sets cookies without Secure or HttpOnly flags.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-27764?
CVE-2021-27764 is a high-severity vulnerability in HCL BigFix WebUI, published on 6 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cookie without HTTPONLY flag set. NUMBER cookie(s) was set without Secure or HTTPOnly flags. The images show the cookie with the missing flag. (WebUI)
Which versions are affected by CVE-2021-27764?
It affects 1 product.
Products include Hcltech Bigfix Webui.
How do I fix CVE-2021-27764?
No fix has been published for CVE-2021-27764 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27764 being exploited?
There is no known exploitation of CVE-2021-27764 in the wild and no public exploit code.
Other vulnerabilities in HCL BigFix WebUI
- CVE-2022-38655 HCL BigFix WebUI is affected by a missing-permission-check vulnerability
- CVE-2023-28021 BigFix WebUI is vulnerable to use of a risky cryptographic algorithm
- CVE-2023-28019 An SQL injection affects BigFix WebUI API
- CVE-2020-4104 Cross-site scripting in HCL BigFix WebUI
- CVE-2023-28023 HCL BigFix WebUI Software Distribution is affected by a cross site server request forgery vulnerability
Sources
Also known as GHSA-m754-rpq6-3vf7.