Cyber Resilience

CVE-2021-27770

Medium

Published: 12 May 2022

Published
12 May 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
EPSS Score 0.0035 58.0th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-27770 is a medium-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Hcltech Sametime. Its CVSS base score is 6.8 (Medium).

Operationally, ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting…

more

will take place.

CWE(s)
CWE-472NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hcltech
sametime
11.6

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References