Common Weakness Enumeration

CWE-1027

Grouping Prohibited

OWASP Top Ten 2017 Category A1 - Injection

Status: Incomplete

API response cwe.mitre.org

Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017.

Grouping entries organize the catalogue and should not be used to map the root cause of a vulnerability.

Mapping guidance

This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.

See member weaknesses of this category.

Relationships and members
Has Member: CWE-77 · View CWE-1026
Has Member: CWE-78 · View CWE-1026
Has Member: CWE-88 · View CWE-1026
Has Member: CWE-89 · View CWE-1026
Has Member: CWE-90 · View CWE-1026
Has Member: CWE-91 · View CWE-1026
Has Member: CWE-564 · View CWE-1026
Has Member: CWE-917 · View CWE-1026
Has Member: CWE-943 · View CWE-1026
Content history
Submission: CWE Content Team · MITRE · 2018-01-22 · CWE 3.1
Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated References

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated References

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Mapping_Notes, Type

2 vulnerabilities reference this CWE, most recent first.

CVE-2025-59874 (GCVE-0-2025-59874)

Vulnerability from cvelistv5 – Published: 2026-06-04 12:14 – Updated: 2026-06-04 13:55
VLAI
Title
HCL Hive Telco Observability is affected by  a Required directives missing from the CSP .
Summary
HCL Hive Telco Observability is affected by  a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable.
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-04 13:55 UTC
CWE
  • CWE-1027 - Missing Required Cryptographic Step
Assigner
HCL CNA under the mitre root
CNA scorecard C 64/100 over 196 records in the last 180 days details
References
Impacted products
Vendor Product Version
HCL Hive Affected: 1.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59874",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T13:55:00.434706Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T13:55:31.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Hive",
          "vendor": "HCL",
          "versions": [
            {
              "status": "affected",
              "version": "1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "HCL Hive Telco Observability is affected by \u0026nbsp;a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable."
            }
          ],
          "value": "HCL Hive Telco Observability is affected by \u00a0a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing essential directives can leave a site vulnerable."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1027",
              "description": "CWE-1027: Missing Required Cryptographic Step",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T12:14:56.160Z",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128725"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "HCL Hive Telco Observability is affected by \u00a0a Required directives missing from the CSP .",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2025-59874",
    "datePublished": "2026-06-04T12:14:56.160Z",
    "dateReserved": "2025-09-22T15:00:11.104Z",
    "dateUpdated": "2026-06-04T13:55:31.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2021-27021 (GCVE-0-2021-27021)

Vulnerability from cvelistv5 – Published: 2021-07-20 10:44 – Updated: 2024-08-03 20:40
VLAI
Summary
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
Severity
No CVSS data available.
CWE
  • CWE-1027 - [CWE-1027|https://cwe.mitre.org/data/definitions/1027.html]
Assigner
puppet CNA
CNA scorecard – unranked: 0 records in the last 180 days, 10 needed details
References
Impacted products
Vendor Product Version
n/a Puppet DB Affected: All prior versions before Puppet DB 6.17.0, 7.4.1, Puppet Platform 6.23, 7.8.0 and PE 2021.2, 2019.8.7
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T20:40:47.020Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://puppet.com/security/cve/cve-2021-27021/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Puppet DB",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "All prior versions before Puppet DB 6.17.0, 7.4.1, Puppet Platform 6.23, 7.8.0 and PE 2021.2, 2019.8.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1027",
              "description": "[CWE-1027|https://cwe.mitre.org/data/definitions/1027.html]",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-07-20T10:44:49.000Z",
        "orgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
        "shortName": "puppet"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://puppet.com/security/cve/cve-2021-27021/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@puppet.com",
          "ID": "CVE-2021-27021",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Puppet DB",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All prior versions before Puppet DB 6.17.0, 7.4.1, Puppet Platform 6.23, 7.8.0 and PE 2021.2, 2019.8.7"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "[CWE-1027|https://cwe.mitre.org/data/definitions/1027.html]"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://puppet.com/security/cve/cve-2021-27021/",
              "refsource": "MISC",
              "url": "https://puppet.com/security/cve/cve-2021-27021/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ca2a266c-be2f-4d4b-92d0-47b76b1a9c4e",
    "assignerShortName": "puppet",
    "cveId": "CVE-2021-27021",
    "datePublished": "2021-07-20T10:44:49.000Z",
    "dateReserved": "2021-02-09T00:00:00.000Z",
    "dateUpdated": "2024-08-03T20:40:47.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

No mitigation information available for this CWE.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list