Vulnerability · Published Jun 7, 2022 · Assigned by HCL

CVE-2021-27786HCL OneTest Server is vulnerable to Cross Origin Resource Sharing: Arbitrary Origin Trusted

Medium 4.6

In plain English

A medium-severity security flaw in HCL OneTest Server from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.6%top 51.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Cross-origin resource sharing (CORS) enables browsers to perform cross domain requests in a controlled manner. This request has an Origin header that identifies the domain that is making the initial request and defines the protocol between a browser and server to see if the request is allowed. An attacker can take advantage of this and possibly carry out privileged actions and access sensitive information when the Access-Control-Allow-Credentials is enabled.

Affected products (as reported)

Vendor	Product	Versions
HCL Software	HCL OneTest Server	10.0, 10.1, 10.2

Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0098603 x_refsource_MISC