Log in Start free

Vulnerability · Published May 31, 2022 · Assigned by HCL

CVE-2021-27778HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information.

Medium 4.9

In plain English

A medium-severity cross-site scripting in HCL Traveler from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium
Exploit odds (30 days)0.4%top 67.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

Affected products (as reported)

VendorProductVersions
HCL Software HCL Traveler 12.0.1.0 and earlier

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L

References