CVE-2024-30122

HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:hcltech:sametime::::::::
	cpe:2.3:a:hcltech:sametime:12.0.2:-::::::

History

25 Nov 2024, 18:15

Type	Values Removed	Values Added
CWE		CWE-922
CVSS	v2 : ~~unknown~~ v3 : ~~5.3~~	v2 : unknown v3 : 5.8

06 Nov 2024, 22:33

Type	Values Removed	Values Added
CPE		cpe:2.3:a:hcltech:sametime:::::::: cpe:2.3:a:hcltech:sametime:12.0.2:-::::::
References	~~() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627 -~~	() https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627 - Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~5.8~~	v2 : unknown v3 : 5.3
First Time		Hcltech Hcltech sametime
CWE		NVD-CWE-noinfo

25 Oct 2024, 12:56

Type	Values Removed	Values Added
Summary		(es) HCL Sametime se ve afectado por encabezados HTTP relacionados con la seguridad mal configurados. Se identificó que faltaban algunos encabezados HTTP en las respuestas del servicio web. Esto provocará un tratamiento predeterminado menos seguro del navegador para las políticas controladas por estos encabezados.

23 Oct 2024, 15:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-10-23 15:15

Updated : 2024-11-25 18:15

NVD link : CVE-2024-30122

Mitre link : CVE-2024-30122

CVE.ORG link : CVE-2024-30122

JSON object : View

Products Affected

hcltech

sametime

CWE

NVD-CWE-noinfo CWE-922

Insecure Storage of Sensitive Information

{"id": "CVE-2024-30122", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2024-10-23T15:15:30.390", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0115627", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-922"}]}], "descriptions": [{"lang": "en", "value": "HCL Sametime is impacted by misconfigured security related HTTP headers. It was identified that some HTTP headers were missing on web service responses. This will lead to less secure browser default treatment for the policies controlled by these headers."}, {"lang": "es", "value": "HCL Sametime se ve afectado por encabezados HTTP relacionados con la seguridad mal configurados. Se identific\u00f3 que faltaban algunos encabezados HTTP en las respuestas del servicio web. Esto provocar\u00e1 un tratamiento predeterminado menos seguro del navegador para las pol\u00edticas controladas por estos encabezados."}], "lastModified": "2024-11-25T18:15:11.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:sametime:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FDA15EE5-1675-469C-BF7B-DB9FDE95F338", "versionEndExcluding": "12.0.2"}, {"criteria": "cpe:2.3:a:hcltech:sametime:12.0.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6A54E0B-DB62-4674-B57D-827A55BBE2CA"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}