A vulnerability in HCL Sametime for Android allows hostnames to be written to application logs and reveals certain URLs. This exposes potentially sensitive configuration details to anyone who can read the logs, thereby increasing the risk of reconnaissance and targeting. The weakness is identified as CWE-532, a sensitive data exposure flaw that can compromise privacy or aid in further exploitation.

The affected product is HCL Sametime for Android. No specific version information was supplied, so all current releases of this application should be treated as potentially vulnerable until an official patch or update is issued by the vendor.

The CVSS score of 3.3 classifies this flaw as low severity, and the EPSS score indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack scenario involves an attacker with access to the device or its local storage, reading the log files to harvest exposed hostnames and URLs. Because the exploit requires only local or accessible log reading, the risk to remote attackers is limited. Nonetheless, the exposed information could assist in future attacks or data exfiltration.