CVE-2021-27772CWE-285

HCL Sametime is vulnerable to an information disclosure

High · published May 12, 2022

CVSS v3.1
7.1
EPSS
1%
Percentile
51.6
In the wild
Unconfirmed
What it is

Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00675 · 51.6th percentile
Weakness
CWE-285 · Improper Authorization
Published
2022-05-12T21:25Z
EPSS history
Timeline
  • 12 MAY 21:25Z
    HCL Sametime is vulnerable to an information disclosure
    cvelistv5