CVE-2023-28325

2023-05-1122:15:09

CWE-285

CWE-287

[email protected]

web.nvd.nist.gov

cve-2023-28325

improper authorization

vulnerability

rocket.chat

nvd

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

0.0005 Low

EPSS

Percentile

18.4%

JSON

An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.

Affected configurations

NVD

Node

rocket.chatrocket.chatRange<6.0.0

CPENameOperatorVersion
rocket.chat:rocket.chatrocket.chatlt6.0.0

CPE	Name	Operator	Version
rocket.chat:rocket.chat	rocket.chat	lt	6.0.0

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Rocket.Chat",
    "versions": [
      {
        "version": "This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions",
        "status": "affected"
      }
    ]
  }
]