CVE-2021-27771: Hcltech Sametime

High severity, CVSS 7.6. EPSS: 0.7% chance of exploitation in the next 30 days.

User SID can be modified resulting in an Arbitrary File Upload or deletion of directories causing a Denial of Service. When interacting in a normal matter with the Sametime chat application, users hold a cookie containing their session ID (SID). This value is also used when sending chat messages, receiving notifications and/or transferring files.

Affected products

• Hcltech Sametime: version 11.6 only

Published 2022-05-12. Last modified 2026-06-17.