The vulnerability is a case of insufficient input sanitization in HCL Sametime. Unsanitized user input is accepted and used by the application without adequate validation, creating a path for potential injection attacks. If an attacker can supply malicious data, they could manipulate application behavior or exfiltrate data, resulting in potential confidentiality or integrity compromise. The weakness is categorized under CWE‑20, Improper Input Validation.

The flaw affects older releases of HCL Software’s HCL Sametime. The issue was corrected in version 12.0.4 and later. Any deployment still running a pre‑12.0.4 version remains vulnerable. Exact affected sub‑versions are not enumerated in the available data.

The CVSS score of 4.3 classifies the risk as moderate. No EPSS score is available, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation at this time. The likely attack vector is through web interfaces or APIs that accept user input. Exploitation would require the attacker to supply crafted input; therefore the threat is manageable but warrants remediation.