CVE-2021-27766 — Improper Privilege Management in Bigfix Platform

CWE-269 — Improper Privilege Management3 documents3 sources
Severity
7.8HIGHNVD
CNA6.7
EPSS
0.0%
top 86.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Hcltech Bigfix PlatformHCL Software Bigfix Platform
Timeline
PublishedMay 6
Latest updateMay 7

Description

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDhcltech/bigfix_platform9.5 — 9.5.18+1
▶CVEListV5hcl_software/bigfix_platform9.5 - 9.5.18, 10 - 10.0.5

🔴Vulnerability Details

2
GHSA
GHSA-xw39-fhvp-3jj6: The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perf↗2022-05-07
▶
CVEList
HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability↗2022-05-06
▶
CVE-2021-27766 — Improper Privilege Management | cvebase