Lucene search

HCLCVELIST:CVE-2023-37540

HistoryFeb 23, 2024 - 7:00 a.m.

CVE-2023-37540 HCL Sametime Chat is affected by an unimplemented feature in the UI

2024-02-2307:00:59

HCL

www.cve.org

hcl sametime chat

unimplemented feature

potential data exposure

secure storage

eclipse feature

CVSS3

3.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

4.6

Confidence

High

EPSS

Percentile

9.0%

JSON

Sametime Connect desktop chat client includes, but does not use or require, the use of an Eclipse feature called Secure Storage. Using this Eclipse feature to store sensitive data can lead to exposure of that data.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HCL Sametime Chat",
    "vendor": "HCL Software",
    "versions": [
      {
        "status": "affected",
        "version": "11.5, 11.6, 11.6 IF1, 12.0, 12.0 FP1, 12.0.1, 12.0.1 FP1"
      }
    ]
  }
]

References

support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082