This vulnerability allows hostnames to be written in both application logs and certain URLs, exposing sensitive information that could aid in system enumeration or mapping. It is a classic case of insecure logging that violates confidentiality by leaking environment details and is classified under CWE-532.

The affected product is HCL Software’s Sametime for iOS. No specific version range is provided, so all installations of this mobile collaboration app should be considered vulnerable unless a later release contains a fixed logging configuration.

The CVSS score of 3.3 indicates a low impact, and the EPSS score of less than 1% shows a very low likelihood of exploitation as of the current data. The vulnerability is not listed in the CISA KEV catalog. Exploitation likely requires the attacker to gain some level of access to the device or to intercept the logs or URLs that the application generates, so it is largely an opportunistic or local attack vector rather than a remote exploit.