Medium severity · published May 12, 2022
CVE-2021-27772
Users are able to read group conversations without actively taking part in them
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sametime · Hcltech
11.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-27772
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-27772
Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430
More from Sametime
8.8
CVE-2023-50349
HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
8.8
CVE-2021-27770
The vulnerability was discovered within the “FaviconService”
7.6
CVE-2021-27771
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service
7.5
CVE-2023-45696
HCL Sametime is impacted by an autocomplete enabled vulnerability
7.5
CVE-2023-45718
HCL Sametime is impacted by a failure to invalidate sessions