Broken Server-Side Validation in HCL Sametime
CVE-2025-31966

2.7LOW

Key Information:

Vendor

HCL Software
Status
Sametime
Vendor
CVE Published:
17 March 2026

What is CVE-2025-31966?

HCL Sametime suffers from a vulnerability that stems from insufficient server-side validation mechanisms. While the application does perform client-side input verification, these checks are not applied by the server itself. This gap allows an attacker to bypass the input restrictions by crafting and sending malicious HTTP requests directly to the server, potentially compromising the integrity of the system or accessing unauthorized data.

Affected Version(s)

Sametime Version 2.0.2 FP2 and older

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.