CVE-2023-45696

HCL Sametime is impacted by an autocomplete enabled vulnerability

Medium4.0EPSS 0.44%

Published: 10 Feb 2024
Updated: 3 Jun 2025
Reserved: 10 Oct 2023
Assigned by: HCL

Description

Sametime is impacted by sensitive fields with autocomplete enabled in the Legacy web chat client. By default, this allows user entered data to be stored by the browser.

Scores

CVSS scores of CVE-2023-45696, by who scored it
Scored by	CVSS	Score	Vector
HCLCNA (assigner)	3.1	Medium4.0	CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.44% · top 61% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.0.

Weakness

CWE-524 Use of Cache Containing Sensitive Information (opens in a new tab)All about CWE-524 and its CVEs

Affected products

HCL Software · HCL Sametime
- affected 11.5, 11.6, 11.6 IF1, 12.0, 12.0 FP1, 12.0.1, 12.0.1 FP1

References (1)

https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0109082 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2023-45696](https://trackcve.app/badge/CVE-2023-45696.svg)](https://trackcve.app/cve/CVE-2023-45696)

Record last updated 3 Jun 2025, 18:54 UTC.