CVE-2021-27771CWE-22CWE-434
HCL Sametime is susceptible a file transfer service vulnerability
High · published May 12, 2022
What it is
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
The record
Technical detail
- CVSS v3.1
- 8.2 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00732 · 53.9th percentile
- Weaknesses
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-434 · Unrestricted Upload of File with Dangerous Type
- Published
- 2022-05-12T21:25Z
EPSS history
Timeline