Vulnerability · Published Oct 31, 2022 · Assigned by HCL
CVE-2021-27784HCL Launch container images may contain non-unique https certificates and database encryption key
Medium 5.9
In plain English
A medium-severity broken cryptography in HCL Launch from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.2%top 85.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions and tools to replace the non-unique keys and certificates. This does not affect the standard installer packages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HCL Software | HCL Launch | 7.0.0.0 - 7.0.52; 7.1.0.0 - 7.1.0.1.ifix01; 7.2.0.0 - 7.2.3.0 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N