8.2
High
CVE-2021-27771 User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service
Description
User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sametime | 11.6 | No fix stated |
Other CVEs of Sametime
The 8 CVEs of Sametime →
CVE-2023-50355
HCL Sametime is impacted by the error messages containing sensitive information
3.6
Low
CVE-2024-30124
HCL Sametime is impacted by insecure services in-use on the UIM client by default
4.0
Medium
CVE-2024-30122
HCL Sametime is impacted by misconfigured security related HTTP headers
5.8
Medium
CVE-2021-27773
This vulnerability allows users to execute a clickjacking attack in the meeting's chat
4.2
Medium