CVE-2022-42446: HCL Sametime 12.0 and 12.0FP1 anonymous users have directory lookup access
Published Nov 30, 2022
·Updated
Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and potentially create chats with internal users.
Affected Software
2 affected components
hcltech Sametime=12.0
hcltech Sametime=12.0-fp1
Event History
Nov 30, 2022
CVE Published
via MITRE·10:54 PM
Data Sourced
via MITRE·10:54 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2022-42446?
CVE-2022-42446 has been classified as a high severity vulnerability due to the risks of unauthorized access and potential data exposure.
2
How do I fix CVE-2022-42446?
To fix CVE-2022-42446, you should disable anonymous access for users in HCL Sametime 12 by adjusting the relevant settings.
3
Which versions of HCL Sametime are affected by CVE-2022-42446?
CVE-2022-42446 affects HCL Sametime versions 12.0 and 12.0-fp1.
4
What are the risks associated with CVE-2022-42446?
The risks associated with CVE-2022-42446 include unauthorized browsing of the User Directory and creating chats with internal users.
5
Is there a patch available for CVE-2022-42446?
Yes, updates that address CVE-2022-42446 are available through HCL's support channels.