EUVD-2025-210999
GHSA-p9wv-23fc-6q8m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious input/link for Sametime
-
DeliveryDeliver to victim via link or message
-
ExploitVictim opens content (UI:R)
-
ExecutionUnsanitized input processed by app
-
ImpactLimited sensitive information disclosed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires user interaction (UI:R) - a victim must open or interact with attacker-supplied content processed by an HCL Sametime web interface - and no authentication is indicated (PR:N). The limiting factors are significant: impact is confined to low confidentiality (read-only information exposure, no integrity or availability effect), and the required user interaction means an attacker must socially engineer a target rather than exploit autonomously. HCL's advisory does not specify which product feature, input field, or configuration is affected, so the exact triggering condition cannot be pinned down from available data; affected versions should be confirmed against HCL KB0132652. |
| Impact | This is a low-to-moderate priority issue whose real-world risk is constrained on nearly every axis. The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) describes a network-reachable, low-complexity flaw requiring no authentication but requiring victim user interaction, with only low confidentiality impact and no integrity or availability impact. There is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept - so exploitation is: no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (a UI-triggered, read-only, low-impact web issue), not conflicting. The dominant caveat is data poverty, not data conflict: HCL's advisory is generic ('did not appropriately sanitize user input') and names no specific feature, endpoint, or affected version, so the concrete exploitability cannot be verified from the provided material - verify affected builds and the specific vector with HCL KB0132652. Net: a real but modest hardening fix, not an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious link or input payload targeting an HCL Sametime web interface and lures an authenticated or unauthenticated user into clicking it (UI:R). Because user input is trusted without sufficient sanitization (CWE-20), the payload is reflected/processed in the victim's session and discloses limited sensitive information (C:L). No public exploit code is available, and the low impact and required user interaction limit practicality. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Insufficient input sanitization in HCL Sametime allows remote, unauthenticated attackers to expose limited information to a victim who interacts with attacker-controlled content processed by the product's web interface. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3), exploitation cannot occur autonomously - the attacker must socially engineer a target into opening or interacting with crafted input - and the resulting impact is read-only information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation has been identified at time of analysis, and HCL's advisory (KB0132652) does not specify which feature, input field, or configuration is affected.
RemediationAI
HCL has published vendor guidance for this issue at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132652 - patch availability is per the vendor advisory, and because no exact fixed version is stated in the available data, administrators should consult KB0132652 directly to identify the patched HCL Sametime build and upgrade to it (or to the latest available release) rather than assuming a version number. Until the upgrade is applied and the specific vulnerable input path is known, the most effective compensating control is reducing exposure of Sametime web interfaces: restrict them to trusted networks or VPN, or place them behind an authenticating reverse proxy, accepting the trade-off that external/guest access is curtailed. Because exploitation hinges on a user interacting with attacker-supplied content (UI:R, PR:N), reinforcing user guidance not to open unsolicited links or messages in Sametime measurably lowers the attack success rate at essentially no operational cost, though it is not a technical fix. A WAF or reverse proxy with strict input-validation rules on Sametime endpoints can block malformed parameters, but the trade-off is a real risk of false positives that break legitimate message content, so rules must be tuned in monitor mode first. Given that the assessed impact is low confidentiality exposure only, with no public exploit identified, these controls can be staged on a normal rather than emergency patch cycle.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-20 (Improper Input Validation) in the broader CWE-20 family: HCL Sametime accepts user-supplied input and implicitly or explicitly treats it as trusted without adequate sanitization. The affected component is reachable over the network (AV:N) with no privileges required (PR:N), but the scoring reflects a reflected/interaction-dependent pattern - a victim must trigger processing of the crafted input (UI:R) before any data is disclosed. The single-scope, low-confidentiality profile (S:U/C:L/I:N/A:N) indicates the outcome is information exposure rather than code execution, session hijacking, or data tampering; if this were an XSS-style flaw with session impact, integrity and scope metrics would typically read higher, so the assessed impact should not be escalated beyond read-only disclosure. The CPE entry cpe:2.3:a:hcl_software:hcl_sametime:*:*:*:*:*:*:*:* uses an unconstrained version wildcard, meaning the data does not map the flaw to a discrete release line; the exact affected versions, the vulnerable endpoint, and the triggering input must be confirmed against HCL KB0132652, since the public description is generic boilerplate that does not name the feature involved.
Know when Hcl Sametime gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-reachable web flaw needing no auth but requiring victim interaction (UI:R); only limited information exposure per the Information Disclosure tag, so C:L and I:N/A:N.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB