CVE-2022-42446 - HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access

Back Back to CVE browser

MEDIUM

HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access

Published Nov 30, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.

Affected products

Vendor HCL Software Product HCL Sametime Default
unaffected
- Version
  12.0, 12.0FP1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

HCL Software

HCL Sametime

unaffected

Version	Status	Constraints
12.0, 12.0FP1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-276

Incorrect Default Permissions

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45519
Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101768
MitigationVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-45519		Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0101768		MitigationVendor Advisory