Lucene search
China National Vulnerability DatabaseCNVD-2022-70581HistorySep 28, 2022 - 12:00 a.m.
Rocket.Chat input validation error vulnerability
2022-09-2800:00:00
China National Vulnerability Database
www.cnvd.org.cn
27
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Rocket.Chat, an open source team chat software, is vulnerable due to an input validation error in the getUsersOfRoom Meteor server method, which fails to type-validate input data. An authenticated attacker could use this vulnerability to enumerate existing rooms and subscribed users.
| CPE | Name | Operator | Version |
|---|---|---|---|
| Rocket.Chat Rocket.Chat >=4.8.0， | lt | 4.8.2 | |
| Rocket.Chat Rocket.Chat | lt | 4.7.5 |
Related
prion
prion
Improper access control
2022-09-23 19:15:00
osv
osv
CVE-2022-32226
2022-09-23 19:15:11
hackerone
hackerone
Rocket.Chat: getUsersOfRoom discloses users in private channels
2021-11-25 17:35:52
cve
cve
CVE-2022-32226
2022-09-23 19:15:00
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Related for CNVD-2022-70581