CVE-2021-27762: medium-severity vulnerability in HCL Software BigFix Platform
HCL BigFix Platform is affected by misconfigured security-related HTTP headers
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The HCL BigFix Platform web interface is missing or incorrectly configured security headers in its HTTP responses. These headers help protect against common web attacks like clickjacking and data injection, so their absence weakens browser-level security protections.
The vulnerability stems from missing or misconfigured HTTP security headers (such as X-Frame-Options, Content-Security-Policy, X-Content-Type-Options) in web responses from the HCL BigFix Platform. An attacker can exploit this through client-side attacks (e.g., clickjacking, MIME-sniffing) if the application lacks proper header enforcement, affecting users who interact with the platform in a browser.
In the same product, most dangerous first.