CVE-2021-27770: medium-severity vulnerability in HCL Software Sametime
HCL Sametime is vulnerable to arbitrary HTTP requests
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL Sametime's FaviconService accepts a base64-encoded URL and fetches it from the server, allowing attackers to make arbitrary HTTP requests to internal or external systems by manipulating the URL parameter passed through the meetings function.
The FaviconService endpoint accepts base64-encoded URLs that are server-side requested without proper validation, enabling SSRF (Server-Side Request Forgery) attacks. An authenticated attacker can craft malicious URLs through the meetings function to access internal resources, bypass firewalls, or probe internal network infrastructure.
In the same product, most dangerous first.