CVE-2022-35249

2022-09-2318:28:12

CWE-200

hackerone

www.cve.org

rocket.chat

information disclosure

vulnerability

AI Score

4.7

Confidence

High

EPSS

0.001

Percentile

24.8%

JSON

A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

CNA Affected

[
  {
    "product": "Rocket.Chat",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in version 5.0>"
      }
    ]
  }
]

References

hackerone.com/reports/1410246