HCL BigFix Platform Client is affected by a Privilege Escalation Vulnerability
CVE-2021-27766

6.7MEDIUM

Key Information:

Vendor
Hcl Software
Status
Bigfix Platform
Vendor
CVE Published:
6 May 2022

Summary

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed.

Affected Version(s)

BigFix Platform 9.5 - 9.5.18, 10 - 10.0.5

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_a...
x_refsource_MISC
https://github.com/mandiant/Vulnerability-Disclosures/blo...
x_refsource_MISC

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HCL Software would like to thank Mandiant for responsibly reporting this vulnerability.
.