High severity · published Mar 4, 2022
CVE-2021-27756
"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BC
Bigfix Compliance · Hcltech
2.0 before 2.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27756
Mitigation
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977
More from Bigfix Compliance
6.5
CVE-2024-23551
HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint
6.2
CVE-2024-30125
HCL BigFix Compliance is affected by an internal server error
5.4
CVE-2024-42212
HCL BigFix Compliance is affected by an improper or missing SameSite attribute
5.4
CVE-2024-30140
HCL BigFix Compliance is affected by unvalidated redirects and forwards
5.3
CVE-2023-37525
HCL BigFix Compliance is vulnerable to a sensitive information disclosure