CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests
An attacker can exploit the FaviconService to make arbitrary HTTP requests, potentially accessing internal resources or bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-27770?
CVE-2021-27770 is a medium-severity server-side request forgery vulnerability in HCL Software Sametime, published on 12 May 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place.
Weakness: CWE-472
Which versions are affected by CVE-2021-27770?
It affects 1 product.
Products include Hcltech Sametime.
How do I fix CVE-2021-27770?
No fix has been published for CVE-2021-27770 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-27770 being exploited?
There is no known exploitation of CVE-2021-27770 in the wild and no public exploit code.
Other vulnerabilities in HCL Software Sametime
- CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability
- CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure
- CVE-2022-42446 HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
- CVE-2023-50349 HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-30122 HCL Sametime is impacted by misconfigured security related HTTP headers
Sources
Also known as GHSA-mxvv-v7w8-j88h.