Lucene search

HackeroneCVE-2024-37405

HistoryJul 12, 2024 - 4:15 p.m.

CVE-2024-37405

2024-07-1216:15:03

CWE-94

hackerone

web.nvd.nist.gov

livechat

messages

nosql

injection

vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.3%

JSON

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.

Affected configurations

Vulners

Vulnrichment

Node

rocket.chatrocket.chatRange<6.10.0

VendorProductVersionCPE
rocket.chatrocket.chat*cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rocket.chat	rocket.chat	*	cpe:2.3:a:rocket.chat:rocket.chat::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "vendor": "Rocket.Chat",
    "product": "Rocket.Chat",
    "versions": [
      {
        "version": "6.10.0",
        "status": "affected",
        "lessThan": "6.10.0",
        "versionType": "semver"
      }
    ]
  }
]

References

hackerone.com/reports/2580062

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

Confidence

Low

EPSS

Percentile

9.3%

JSON

Related for CVE-2024-37405