Back to Database
Status published
Medium
CVE-2021-27778
HCL Traveler is susceptible to a cross-site scripting vulnerability which could allow an attacker to execute a malicious script to access sensitive information.
Vulnerability Description
HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27778
Credits & Attribution
No credits recorded in the NVD database.
More from HCL Software
View All →CVE-2025-62346
HCL Glovius Cloud is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability
Medium
6.8
CVE-2025-62340
HCL iControl was affected by Inadequate Session Timeout vulnerability
Low
3.1
CVE-2025-62330
HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information
Medium
5.9
CVE-2025-62329
HCL DevOps Deploy / HCL Launch is susceptible to an insufficient session expiration vulnerability
Medium
5
CVE-2025-59873
Session Token Exposure via URL Query Parameters
Medium
5.9
Affected Vendor
HCL Software
View all reports →Affected Software
HCL Traveler
Vulnerable Versions:
12.0.1.0 and earlier
Timeline
Official Publish:
May 31st, 2022
Last Modified:
September 17th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:L