CVE Vulnerability

CVE-2021-27756

"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it."

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0096977 Mitigation Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:hcltech:bigfix_compliance:*:*:*:*:*:*:*:*
Information

Published : 2022-03-04 10:15

Updated : 2022-03-12 02:05

NVD link : CVE-2021-27756

Mitre link : CVE-2021-27756

Products Affected
No products.
CWE
CWE-327