Loading vulnerability…
CVE-2021-27748 is a server-side request forgery vulnerability in HCL Digital Experience, including on-premises and container deployments. Proxy functionality could make server-side requests through configured outbound connections. Restricted destination policies could be bypassed by chaining requests through an open redirect on an allowlisted external service, causing the Digital Experience server to request attacker-selected arbitrary URLs. The issue affects Portal proxy functionality and was addressed through HCL maintenance and removal of the relevant outbound HTTP connection configuration.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A server-side request forgery vulnerability in HCL WebSphere Portal (now HCL Digital Experience) proxy functionality. Restricted default proxy routes can follow a Lotus Domino open redirect, converting an allowlisted-origin SSRF into arbitrary URL access; other identified proxy routes permit broader pre-auth SSRF, including full response reads and, for one route, multiple HTTP methods and request bodies.
A CVE identifier listed as not found in NVD; no vulnerability details are provided in the content.
An SSRF vulnerability in HCL WebSphere Portal (HCL Digital Experience) proxy functionality. Restricted proxy routes can be converted into arbitrary-request SSRF through a Lotus Domino RedirectTo open-redirect chain; other identified proxy routes allow more direct full-read SSRF and, in one case, arbitrary HTTP methods and request bodies.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.