PT-2022-21157 · Rocket.Chat · Rocket.Chat

Paulocsanz · Published 2022-09-23 · Updated 2022-09-27 · CVE-2022-32219

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 4.7.5

Description An information disclosure issue exists, allowing virtually any authenticated user to access any data, except password hashes, of any other authenticated user. This is due to the "users.list" REST endpoint processing a query parameter from JSON and executing Users.find(queryFromClientSide).

Recommendations For versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "users.list" REST endpoint to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-32219

Affected Products

Rocket.Chat

References · 4

• 🔥 https://hackerone.com/reports/1140631 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-32219 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32219 · Vendor Advisory
• https://t.me/cibsecurity/50381 · Telegram Post