CVE-2021-27780 HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction
Unauthenticated attackers can exploit XML interaction flaws to access sensitive data or bypass security controls in HCL BigFix Mobile.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27780?
CVE-2021-27780 is a medium-severity vulnerability in HCL BigFix Mobile / Modern Client Management, published on 27 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
Weakness: CWE-112
Which versions are affected by CVE-2021-27780?
It affects 2 products.
Products include Hcltech Bigfix Mobile, Hcltech Modern Client Management.
How do I fix CVE-2021-27780?
No fix has been published for CVE-2021-27780 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-27780 being exploited?
There is no known exploitation of CVE-2021-27780 in the wild and no public exploit code.
Other vulnerabilities in HCL BigFix Mobile / Modern Client Management
- CVE-2021-27783 HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure
- CVE-2023-28014 HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability
- CVE-2021-27781 HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting
- CVE-2025-0276 HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
- CVE-2025-0277 HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)
Sources
Also known as GHSA-q2x2-7xpw-6rm3.