CVE-2021-22910

2021-08-0912:27:46

CWE-75

hackerone

www.cve.org

rocket.chat

sanitization vulnerability

nosql injection

rce

cve-2021-22910

AI Score

9.5

Confidence

High

EPSS

0.002

Percentile

65.1%

JSON

A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.

CNA Affected

[
  {
    "product": "Rocket.Chat server",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed versions: 3.13.2, 3.12.4, 3.11.4"
      }
    ]
  }
]