CVE-2021-27778: Hcltech Traveler

Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days.

HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. An attacker could exploit this vulnerability to execute a malicious script to access any cookies, session tokens, or other sensitive information retained by the browser and used with that site.

Affected products

• Hcltech Traveler: up to and including 12.0.1.0

Published 2022-06-01. Last modified 2026-06-17.