PT-2020-17208 · Rocket.Chat · Rocket.Chat

Published 2020-12-30 · Updated 2021-01-04 · CVE-2020-29594

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 0.74.4 Rocket.Chat versions 1.x prior to 1.3.4 Rocket.Chat versions 2.x prior to 2.4.13 Rocket.Chat versions 3.x prior to 3.7.3 Rocket.Chat versions 3.8.x prior to 3.8.3 Rocket.Chat versions 3.9.x prior to 3.9.1

Description The issue is related to the mishandling of SAML login.

Recommendations For Rocket.Chat versions prior to 0.74.4, update to version 0.74.4 or later. For Rocket.Chat versions 1.x prior to 1.3.4, update to version 1.3.4 or later. For Rocket.Chat versions 2.x prior to 2.4.13, update to version 2.4.13 or later. For Rocket.Chat versions 3.x prior to 3.7.3, update to version 3.7.3 or later. For Rocket.Chat versions 3.8.x prior to 3.8.3, update to version 3.8.3 or later. For Rocket.Chat versions 3.9.x prior to 3.9.1, update to version 3.9.1 or later.

Fix

Related Identifiers

CVE-2020-29594

Affected Products

Rocket.Chat

References · 4

• https://github.com/RocketChat/Rocket.Chat/compare/3.8.2...3.8.3 · Patch
• https://osv.dev/vulnerability/CVE-2020-29594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29594 · Security Note
• https://github.com/RocketChat/Rocket.Chat/releases/tag/3.9.1 · Note