126 matches found
Rocket.Chat Information Disclosure Vulnerability (CNVD-2023-40582)
Rocket.Chat is an open source team chat software. An information disclosure vulnerability exists in versions prior to Rocket.Chat 6.0, which stems from an ACL check in the slash command /mute, after checking if a user is a member of a given channel, which can disclose private channel members to...
CVE-2023-28357
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...
Design/Logic Flaw
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...
PT-2023-21667 · Rocket.Chat · Rocket.Chat
Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command "/mute" occur after checking whether a user is a member of a given channel, leaking private...
CVE-2023-28357
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...
CVE-2023-28357
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...
CVE-2023-28357
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a membe...
Missing Authorization
Mattermost is vulnerable to Missing Authorization. The vulnerability is due to not checking the inviter's permission on the private channel on a team when inviting a user on that same private channel while processing an email invite. This allows an attacker to invite themselves to a private chann...
GHSA-9HJ7-V56G-RHF6 Mattermost fails to properly authentication inviter's permissions to private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Issue Identifier: MMSA-2023-00137...
Mattermost fails to properly authentication inviter's permissions to private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel. Issue Identifier: MMSA-2023-00137...
CVE-2023-1774
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...
Code injection
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...
CVE-2023-1774 Unauthorized email invite to a private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...
CVE-2023-1774 Unauthorized email invite to a private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...
CVE-2023-1774
CVE-2023-1774 concerns Mattermost where processing an email invite to a private channel does not validate the inviter’s permission for that channel. The result is that an attacker can invite themselves to a private channel without proper authorization. The issue centers on the invite handling flo...
CVE-2023-1774 Unauthorized email invite to a private channel
When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel...
Send any message to any to any private channel
Description A user can add any message to a private channel that is not in that channel. This error is because the web application did not check if the sender userid is in that private channel. Proof of Concept Login to website in brower 1 with user A. Login to website in brower 2 with user B. Us...
Rocket.Chat: Mute User can disclose private channel members to unauthorized users
Vulnerability description not provided...
Unspecified Vulnerability in Mattermost Server (CNVD-2020-35439)
Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server that can be exploited by an attacker to modify the Update/Patch Channel endpoints of a private channel...