LiveActive security incident?Get immediate response
CVE Record

CVE-2021-27768: An SSL certificate host verification vulnerability affects HCL Verse for Android

Using the ability to perform a Man-in-the-Middle (MITM) attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however, the application did not process requests post-login.

MediumCVSS 6.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

HCL Verse for Android could accept a certificate whose hostname did not match the server during setup and login. Someone positioned to intercept traffic could expose sensitive account information. The source notes requests after login were not processed, limiting scope, but account exposure makes this important for mobile mail users.

Executive priority

Treat as a moderate mobile email risk. Prioritize if HCL Verse for Android is used for corporate mail, especially by executives, administrators, or users handling sensitive communications.

Technical view

CVE-2021-27768 is a CWE-300 hostname verification flaw in HCL Verse for Android. The described scenario used a transparent proxy and an invalid-hostname certificate during server setup and login flows. CVSS v3.1 is 6.3, with high confidentiality impact and no availability impact.

Likely exposure

Exposure is likely limited to organizations using HCL Verse for Android. Affected versions are unspecified in the supplied sources, so teams should verify installed Android app versions against HCL guidance.

Exploitation context

The source describes MITM interception during setup and login, requiring network position and user interaction. CISA KEV is false, and the bundle provides no evidence of active exploitation in the wild.

Researcher notes

The bundle gives the vulnerability mechanism, CVSS, affected product, and one vendor reference, but not affected version ranges or fix details. Do not infer broader HCL products are affected.

Mitigation direction

  • Review HCL KB0097753 for affected and fixed version guidance.
  • Update HCL Verse for Android according to HCL guidance.
  • Prioritize managed Android devices used for corporate mail access.
  • Avoid setup or login on untrusted networks until remediated.
  • Use mobile device management to enforce approved app versions.

Validation and detection

  • Inventory managed devices running HCL Verse for Android.
  • Compare installed versions against HCL's advisory guidance.
  • Confirm mobile controls enforce the approved Verse app version.
  • Review mobile mail onboarding risk for users on unmanaged networks.
  • Perform any TLS validation testing only in an authorized lab.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-300: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-27768 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.3 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N2.14.2Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

6.3Medium
CVSS 3.1 vector shape for CVE-2021-27768Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
HCL SoftwareVerse for AndroidunspecifiedListed
Weakness

CWE details

CWE-300

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-300 · source CWE mapping

Channel Accessible by Non-Endpoint

Channel Accessible by Non-Endpoint represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs