{
  "id": "CVE-2023-45718",
  "sourceIdentifier": "psirt@hcl.com",
  "published": "2024-02-09T22:15:08.167",
  "lastModified": "2024-09-05T13:14:01.253",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sametime is impacted by a failure to invalidate sessions.  The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session. \u00a0\n"
    },
    {
      "lang": "es",
      "value": "Sametime se ve afectado por un error al invalidar las sesiones. La aplicaci\u00f3n establece valores de cookies confidenciales de forma persistente en los clientes web de Sametime. Cuando esto sucede, los valores de las cookies pueden seguir siendo v\u00e1lidos incluso despu\u00e9s de que un usuario haya cerrado su sesi\u00f3n."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      },
      {
        "source": "psirt@hcl.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
          "attackVector": "PHYSICAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 3.9,
          "baseSeverity": "LOW"
        },
        "exploitabilityScore": 0.3,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-384"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:hcltech:sametime:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "11.5",
              "versionEndExcluding": "12.0.2",
              "matchCriteriaId": "AFB79405-6D48-490D-BBF5-FFC42551C721"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082",
      "source": "psirt@hcl.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}