4.3
Medium
CVE-2022-32228 An information disclosure vulnerability exists in…
Description
An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Rocket.Chat | Versions not published |
References
- hackerone.com hackerone.com
Timeline
- Published
- Last modified
Other CVEs of Rocket.Chat
The 26 CVEs of Rocket.Chat →
CVE-2023-28359
A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat
5.3
Medium
CVE-2023-28325
An improper authorization vulnerability exists in…
6.5
Medium
CVE-2023-28356
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can…
7.5
High
CVE-2023-28358
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature…
6.1
Medium