How severe is CVE-2021-27785?

CVE-2021-27785 has a CVSS 3.x base score of 3.9, rated low severity. It is exploitable over physical access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2021-27785 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-27785?

CVE-2021-27785 affects Hcltechsw Hcl Commerce. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-27785?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-27785 published?

CVE-2021-27785 was published on 2022-07-30 and last updated on 2026-06-17.

CVE-2021-27785

CVE-2021-27785 is a low-severity vulnerability in Hcltechsw Hcl Commerce with a CVSS 3.x base score of 3.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-522.

Key facts

Severity: Low (CVSS 3.x base score 3.9)
EPSS exploit prediction: 0% (7th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-522
Affected product: Hcltechsw Hcl Commerce
Published: 2022-07-30
Last modified: 2026-06-17

Description

HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.

Frequently asked questions

What is CVE-2021-27785?: HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.
How severe is CVE-2021-27785?: CVE-2021-27785 has a CVSS 3.x base score of 3.9, rated low severity. It is exploitable over physical access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2021-27785 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-27785?: CVE-2021-27785 affects Hcltechsw Hcl Commerce. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-27785?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-27785 published?: CVE-2021-27785 was published on 2022-07-30 and last updated on 2026-06-17.

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099765

Affected products (1)

cpe:2.3:a:hcltechsw:hcl_commerce:*:*:*:*:*:*:*:*

More vulnerabilities in Hcltechsw Hcl Commerce

CVE-2020-14275 — Critical (CVSS 9.8): Security vulnerability in HCL Commerce 9.0.0.5 through 9.0.0.13, 9.0.1.0 through 9.0.1.14 and 9.1 through 9.1.4 could…
CVE-2021-27741 — Critical (CVSS 9.1): " Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"
CVE-2022-38656 — High (CVSS 8.6): HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and…
CVE-2020-14274 — High (CVSS 7.5): Information disclosure vulnerability in HCL Commerce 9.0.1.9 through 9.0.1.14 and 9.1 through 9.1.4 could allow a…
CVE-2024-23576 — High (CVSS 7.1): Security vulnerability in HCL Commerce 9.1.12 and 9.1.13 could allow denial of service, disclosure of user personal…
CVE-2021-27751 — Medium (CVSS 4.4): HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some…

All CVEs affecting Hcltechsw Hcl Commerce →

Other CWE-522 (Insufficiently Protected Credentials) vulnerabilities

CVE-2026-7312 — Critical (CVSS 10.0): CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to…
CVE-2026-29128 — Critical (CVSS 10.0): IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g.,…
CVE-2025-54863 — Critical (CVSS 10.0): Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration…
CVE-2024-12799 — Critical (CVSS 10.0): Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64…
CVE-2024-51545 — Critical (CVSS 10.0): Username Enumeration vulnerabilities allow access to application level username add, delete, modify and list…
CVE-2023-1778 — Critical (CVSS 10.0): This vulnerability exists in GajShield Data Security Firewall firmware versions prior to v4.28 (except v4.21) due to…

Browse all CWE-522 (Insufficiently Protected Credentials) vulnerabilities →