CVE-2024-30122 HCL Sametime is impacted by misconfigured security related HTTP headers
HCL Sametime lacks critical security HTTP headers, weakening browser protections and potentially exposing users to client-side attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-30122?
CVE-2024-30122 is a medium-severity vulnerability in HCL Software Sametime, published on 23 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.
Weakness: CWE-922
Which versions are affected by CVE-2024-30122?
It affects 1 product.
Products include Hcltech Sametime.
How do I fix CVE-2024-30122?
No fix has been published for CVE-2024-30122 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-30122 being exploited?
There is no known exploitation of CVE-2024-30122 in the wild and no public exploit code.
Other vulnerabilities in HCL Software Sametime
- CVE-2021-27771 HCL Sametime is susceptible a file transfer service vulnerability
- CVE-2021-27772 HCL Sametime is vulnerable to an information disclosure
- CVE-2021-27770 HCL Sametime is vulnerable to arbitrary HTTP requests
- CVE-2022-42446 HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
- CVE-2023-50349 HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability
Sources
Also known as GHSA-3c76-p447-jmg2.