What is CVE-2021-27772?

CVE-2021-27772 is a high-severity vulnerability in Hcl Software Sametime, classified under Improper Authorization. CVSS score: 7.1/10. Published 2022-05-12.

How severe is CVE-2021-27772?

High severity. CVSS v3 base score is 7.1 out of 10.

Auth bypass in Hcl Software Sametime

CVE-2021-27772

Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start group conversations with multiple users. It was found possible to obtain the contents of these group conversations without being part of it. This could lead to information leakage where confidential information discussed in private groups is read by other users without the users knowledge.

EPSS: 0.006 (46.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L.

Affected products

Hcl Software Sametime — versions 11.6
Hcltech Sametime — versions 11.6

Weakness classification (CWE)

CWE-285 — Improper Authorization

References

psirt@hcl.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-27772?: CVE-2021-27772 is a high-severity vulnerability in Hcl Software Sametime, classified under Improper Authorization. CVSS score: 7.1/10. Published 2022-05-12.
How severe is CVE-2021-27772?: High severity. CVSS v3 base score is 7.1 out of 10.