Lucene search
PRIOn knowledge basePRION:CVE-2023-28357HistoryMay 11, 2023 - 10:15 p.m.
Design/Logic Flaw
2023-05-1122:15:00
PRIOn knowledge base
www.prio-n.com
4
rocket.chat
acl
design flaw
private channel
vulnerability
nvd
slash command
/mute
authenticated users
unauthorized users
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.
| CPE | Name | Operator | Version |
|---|---|---|---|
| rocket.chat | lt | 6.0.0 |
References
Related
cnvd
cnvd
Rocket.Chat Information Disclosure Vulnerability (CNVD-2023-40582)
2023-05-17 00:00:00
osv
osv
CVE-2023-28357
2023-05-11 22:15:09
nvd
nvd
CVE-2023-28357
2023-05-11 22:15:09
cvelist
cvelist
CVE-2023-28357
2023-05-11 00:00:00
hackerone
hackerone
cve
cve
CVE-2023-28357
2023-05-11 22:15:09