CVE-2024-30124: HCL Sametime is impacted by insecure services
HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30124?
CVE-2024-30124 is classified as a moderate severity vulnerability due to the potential for unauthorized access through insecure services.
How do I fix CVE-2024-30124?
To fix CVE-2024-30124, disable the unused legacy REST service on the HCL Sametime UIM client.
What impact does CVE-2024-30124 have on HCL Sametime?
CVE-2024-30124 allows attackers to exploit an insecure, enabled service that can be used to gain unauthorized access.
Which versions of HCL Sametime are affected by CVE-2024-30124?
CVE-2024-30124 affects all versions of HCL Sametime that have the legacy REST service enabled by default.
Is there a workaround for CVE-2024-30124?
As a workaround for CVE-2024-30124, you can configure the UIM client to disable the default legacy REST service.