PT-2023-21644 · Unknown · Rocket.Chat

Priyank_Parmar · Publicado 2023-05-09 · Atualizado 2023-05-17 · CVE-2023-28316

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rocket.chat (affected versions not specified)

Description A security issue has been found in the implementation of 2FA on the rocket.chat platform. When 2FA is activated, other active sessions are not invalidated. This could allow an attacker to keep access to a compromised account even after 2FA is enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2023-28316

Produtos afetados

Rocket.Chat

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-28316 · Aviso do Fabricante
• https://hackerone.com/reports/992280 · Nota
• https://t.me/cvenotify/50651 · Publicação no Telegram
• https://t.me/cibsecurity/63708 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-28316 · Nota de Segurança
• https://t.me/cvenotify/50093 · Publicação no Telegram