CVE-2021-27777highCWE-91

CVE-2021-27777: high-severity vulnerability in HCL Unica

HCL Unica Platform is vulnerable to XML External Entity (XXE) injection

Published · Updated

Follow this CVE+ Monitor Unica

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.8%
In short

HCL Unica Platform has a flaw in how it processes XML files that allows attackers to inject malicious code by inserting harmful references into the XML. This can lead to data theft or system compromise.

Technical detail

The vulnerability exists in XML parsing logic that does not adequately validate or disable external entity resolution. An attacker can craft malicious XML input containing external entity declarations to access sensitive files, perform SSRF attacks, or cause denial of service. Pre-condition requires the ability to submit XML content to the application.

Summary generated and translated by AI from the official description.
XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
HCL Software · HCL Unica