CVE-2021-27760: medium-severity vulnerability in HCL Notes
HCL Notes 11.0 - 11.0.1 FP4 Sametime Embedded chat clients are vulnerable to group chats loading script on restart
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Notes Sametime chat allows an authenticated user to execute malicious code on other chat clients by sending specially formatted messages containing JavaScript. This could let attackers take control of a victim's chat client.
An authenticated attacker can achieve Remote Code Execution (RCE) in HCL Notes 11.0–11.0.1 FP4 Sametime clients by sending a crafted message with embedded JavaScript through the chat interface; the script executes when the target client loads or restarts the group chat, bypassing input validation (CWE-20).
In the same product, most dangerous first.