{"id":"CVE-2024-30124","aliases":["EUVD-2024-28060","GHSA-wfjj-9rr8-m3rh"],"status":"published","title":"HCL Sametime is impacted by insecure services","description":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.","severity":{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00167,"percentile":0.06049,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1188"],"published":"2024-10-23T15:17:24Z","modified":"2026-06-17T07:26:19Z","products":[{"vendor":"hcl","product":"sametime"},{"vendor":"hcl software","product":"sametime"},{"vendor":"hcltech","product":"sametime"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0115627","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30124"},{"url":"https://github.com/advisories/GHSA-wfjj-9rr8-m3rh"}],"sources":{"cve":[{"id":"CVE-2024-30124","title":"HCL Sametime is impacted by insecure services","description":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.","status":"published","published":"2024-10-23T15:17:24.303Z","modified":"2024-10-29T14:36:33.446Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-28060","description":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.","status":"published","published":"2024-10-23T15:17:24Z","modified":"2024-10-29T14:36:33Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:05:15.24326Z"}],"ghsa":[{"id":"GHSA-wfjj-9rr8-m3rh","title":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused...","description":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.","status":"published","published":"2024-10-23T18:33:08Z","modified":"2024-10-29T18:30:36Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:58:38.070803Z"}],"nvd":[{"id":"CVE-2024-30124","description":"HCL Sametime is impacted by insecure services in-use on the UIM client by default. An unused legacy REST service was enabled by default using the HTTP protocol. An attacker could potentially use this service endpoint maliciously.","status":"published","published":"2024-10-23T16:15:05.667Z","modified":"2026-06-17T07:26:19.907Z","cvss":[{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:10:33.928543Z"}]}}