Rocket.Chat up to 6.12.0 Message UpdateOTRAck

Summaryinfo

A vulnerability categorized as problematic has been discovered in Rocket.Chat up to 6.12.0. This affects the function UpdateOTRAck of the component Message Handler. The manipulation results in an unknown weakness. This vulnerability is reported as CVE-2024-46936. No exploit exists.

Detailsinfo

A vulnerability was found in Rocket.Chat up to 6.12.0. It has been classified as problematic. Affected is the function UpdateOTRAck of the component Message Handler. This is going to have an impact on integrity. CVE summarizes:

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. Attackers can abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2024-46936 since 09/15/2024. The exploitability is told to be easy. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2024-42149). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Chat Software

Name

• Rocket.Chat

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.7.0
• 6.7.1
• 6.7.2
• 6.7.3
• 6.7.4
• 6.7.5
• 6.7.6
• 6.7.7
• 6.7.8
• 6.8
• 6.8.0
• 6.8.1
• 6.8.2
• 6.8.3
• 6.8.4
• 6.8.5
• 6.8.6
• 6.9
• 6.9.0
• 6.9.1
• 6.9.2
• 6.9.3
• 6.9.4
• 6.9.5
• 6.9.6
• 6.10
• 6.10.0
• 6.10.1
• 6.10.2
• 6.10.3
• 6.10.4
• 6.10.5
• 6.11
• 6.11.0
• 6.11.1
• 6.11.2
• 6.12.0

License

• free

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion