PT-2022-9858 · Hcl+1 · Sametime

Published 2022-05-12 · Updated 2023-06-30 · CVE-2021-27770

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue was discovered within the FaviconService, which takes a base64-encoded URL and requests it through the webserver. It is assumed that this service is utilized by the meetings function, allowing users to specify an external URL for online meetings.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2021-27770

Affected Products

Sametime

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-27770 · Security Note
• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27770 · Vendor Advisory
• https://t.me/cvenotify/30638 · Telegram Post