Lucene search
HistorySep 23, 2022 - 7:15 p.m.
CVE-2022-32229
information disclosure
rockert.chat
user inputs
mongo db injection
unauthorized users
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
25.0%
A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak private thread messages to unauthorized users via Mongo DB injection.
Affected configurations
Node
rocket.chatrocket.chatRange<5.0
References
Related
cnvd
cnvd
Rocket.Chat chat.getThreadsList information disclosure vulnerability
2022-09-28 00:00:00
osv
osv
CVE-2022-32229
2022-09-23 19:15:11
cvelist
cvelist
CVE-2022-32229
2022-09-23 18:28:13
hackerone
hackerone
Rocket.Chat: API route chat.getThreadsList leaks private message content
2022-01-11 13:21:40
cve
cve
CVE-2022-32229
2022-09-23 19:15:11
prion
prion
Information disclosure
2022-09-23 19:15:00
4.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
0.001 Low
EPSS
Percentile
25.0%
Related for NVD:CVE-2022-32229