CVE-2021-27781 HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting
A stored cross-site scripting vulnerability allows attackers to inject scripts that can steal cookies or session data from users of HCL BigFix Mobile.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-27781?
CVE-2021-27781 is a medium-severity cross-site scripting vulnerability in HCL BigFix Mobile / Modern Client Management, published on 27 May 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
Weakness: CWE-79
Which versions are affected by CVE-2021-27781?
It affects 2 products.
Products include Hcltech Bigfix Mobile, Hcltech Modern Client Management.
How do I fix CVE-2021-27781?
No fix has been published for CVE-2021-27781 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-27781 being exploited?
There is no known exploitation of CVE-2021-27781 in the wild and no public exploit code.
Other vulnerabilities in HCL BigFix Mobile / Modern Client Management
- CVE-2021-27783 HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure
- CVE-2023-28014 HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability
- CVE-2025-0276 HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
- CVE-2025-0277 HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)
- CVE-2023-28012 HCL BigFix Mobile can be affected by a command injection vulnerability
Sources
Also known as GHSA-2r44-78ff-wqc3.