6

CVE-2021-27760

HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hcltech ≫ Hcl Inotes Version 11.0.0
Hcltech ≫ Hcl Inotes Version 11.0.1 Update -
Hcltech ≫ Hcl Inotes Version 11.0.1 Update fixpack1
Hcltech ≫ Hcl Inotes Version 11.0.1 Update fixpack2
Hcltech ≫ Hcl Inotes Version 11.0.1 Update fixpack3
Hcltech ≫ Hcl Inotes Version 11.0.1 Update fixpack4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.68% 0.487
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 2.1 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
NIST 6 6.8 6.4
AV:N/AC:M/Au:S/C:P/I:P/A:P
psirt@hcl.com 4.6 2.1 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097670
Third Party Advisory