CVE-2022-32218

2022-09-2318:28:13

CWE-200

hackerone

www.cve.org

rocket.chat

information disclosure

vulnerability

mongodb

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumeration with Regex MongoDB queries.

CNA Affected

[
  {
    "product": "Rocket.chat",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 4.7.5, 4.8.2 and 5.0>"
      }
    ]
  }
]

References

hackerone.com/reports/1406953