CVE-2022-42446 HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Anonymous users can access the user directory and initiate chats with internal users due to default settings in HCL Sametime.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42446?
CVE-2022-42446 is a medium-severity missing authorization vulnerability in HCL Sametime, published on 30 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
Weakness: CWE-276
Which versions are affected by CVE-2022-42446?
It affects 1 product.
Products include Hcltech Sametime.
How do I fix CVE-2022-42446?
No fix has been published for CVE-2022-42446 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-42446 being exploited?
There is no known exploitation of CVE-2022-42446 in the wild and no public exploit code.
Other vulnerabilities in HCL Sametime
- CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability
- CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure
- CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests
- CVE-2023-50349 HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-30122 HCL Sametime is impacted by misconfigured security related HTTP headers
Sources
Also known as GHSA-r6p7-5w57-87q9.