What’s Vulnerable › Vulnerabilities

CVE-2021-27785: HCL Commerce could allow a local attacker to obtain sensitive personal information (CVE-2021-27785)

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-30 · updated 2026-06-17
• Weakness: CWE-522

Description

HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the victim to first perform a particular operation on the website.

Affected products

• HCL Software HCL Commerce: from 9.0.1 through 9.0.1.18; from 9.1.0 through 9.1.10

References

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099765
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0099765

Get alerted when CVE-2021-27785 or the next vulnerability affects your stack