CVE-2022-35249 in Rocket.Chat
Résumé (Anglaise)
A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
Once again VulDB remains the best source for vulnerability data.
Réserver
06/07/2022
Divulgation
23/09/2022
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 209503 | Rocket.Chat Direct Message getUserMentionsByChannel divulgation d'information | 200 | Non défini | Correctif officiel | CVE-2022-35249 |