Lucene search

HackeroneCVELIST:CVE-2022-32219

HistorySep 23, 2022 - 6:28 p.m.

CVE-2022-32219

2022-09-2318:28:14

CWE-200

hackerone

www.cve.org

information disclosure

rocket.chat

vulnerability

rest endpoint

authenticated user

data access

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.0%

JSON

An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the “users.list” REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.

CNA Affected

[
  {
    "product": "Rocket.Chat",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "fixed in 4.7.5>"
      }
    ]
  }
]

References

hackerone.com/reports/1140631