Vulnerability · Published May 12, 2022 · Assigned by HCL

CVE-2021-27772HCL Sametime is vulnerable to an information disclosure

High 7.1

In plain English

A high-severity security flaw in Sametime from HCL Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.7%top 47.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.

Affected products (as reported)

Vendor	Product	Versions
HCL Software	Sametime	11.6

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430 x_refsource_MISC