Lucene search

HackeroneCVELIST:CVE-2022-32220

HistorySep 23, 2022 - 6:28 p.m.

CVE-2022-32220

2022-09-2318:28:14

CWE-200

hackerone

www.cve.org

rocket.chat

vulnerability

information disclosure

getusermentionsbychannel

private channels

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

32.8%

JSON

An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

CNA Affected

[
  {
    "product": "Rocket.Chat",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "fixed in 5.0.0>"
      }
    ]
  }
]

References

hackerone.com/reports/1410246