Medium severity · published Oct 23, 2024
CVE-2023-50355
HCL Sametime is impacted by generation of error messages containing sensitive information
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Sametime · HCL Software
<=12.0.2 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50355
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50355
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627
More from Sametime
5.3
CVE-2024-30122
HCL Sametime is impacted by misconfigured security related HTTP headers
4.0
CVE-2024-30124
HCL Sametime is impacted by insecure services