This vulnerability (CWE-201) in Vimesoft Corporate Messaging Platform allows sensitive information to be inserted into data sent by the application, which can then be retrieved by an attacker. It affects versions starting from 1.3.0 before 2.0.0. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with high attack complexity, no privileges required, and user interaction needed. The impact is high confidentiality loss without affecting integrity or availability.

Successful exploitation could lead to unauthorized disclosure of sensitive information embedded in sent data. This compromises confidentiality but does not affect data integrity or system availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit exposure by restricting network access to the affected versions and exercising caution with user interactions that trigger data sending. Monitor vendor channels for updates and apply patches promptly once available.