CVE-2021-27777CWE-91

HCL Unica Platform is vulnerable to XML External Entity (XXE) injection

High · published May 12, 2022

CVSS v3.1
7.5
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00846 · 57.7th percentile
Weakness
CWE-91 · XML Injection (aka Blind XPath Injection)
Published
2022-05-12T21:25Z
EPSS history
Timeline
  • 12 MAY 21:25Z
    HCL Unica Platform is vulnerable to XML External Entity (XXE) injection
    cvelistv5