CVE-2021-27771

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-22 CWE-434

Affected software

Vendor	Product	Versions
HCL Software	Sametime	11.6

References

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430Vendor Advisory
https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0097430Vendor Advisory

Timeline

Published: May 12, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277726.5Users are able to read group conversations without actively taking part in them. Next to one to one conversations, users are able to start g CVE-2021-277734.3This vulnerability allows users to execute a clickjacking attack in the meeting's chat.CVE-2021-277745.4User input included in error response, which could be used in a phishing attack.CVE-2021-277777.5XML External Entity (XXE) injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient CVE-2021-277784.8HCL Traveler is vulnerable to a cross-site scripting (XSS) caused by improper validation of the Name parameter for Approved Applications in CVE-2021-277799.1VersionVault Express exposes sensitive information that an attacker can use to impersonate the server or eavesdrop on communications with th CVE-2021-277805.3The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.CVE-2021-277814.8The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.CVE-2021-277827.5HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple inval CVE-2021-277836.5User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.CVE-2021-277847.5The provided HCL Launch Container images contain non-unique HTTPS certificates and a database encryption key. The fix provides directions an CVE-2021-277855.0HCL Commerce's Remote Store server could allow a local attacker to obtain sensitive personal information. The vulnerability requires the vic