PT-2022-21159 · Unknown · Rocket.Chat

Gronke · Published 2022-09-23 · Updated 2023-07-21 · CVE-2022-32220

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 5

Description An information disclosure issue exists due to the getUserMentionsByChannel meteor server method, which discloses messages from private channels and direct messages regardless of the user's access permission to the room.

Recommendations For versions prior to 5, consider disabling the getUserMentionsByChannel method until a patch is available to prevent information disclosure.

Exploit

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2022-32220

Affected Products

Rocket.Chat

References · 4

• 🔥 https://hackerone.com/reports/1410246 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-32220 · Security Note
• https://osv.dev/vulnerability/CVE-2022-32220 · Vendor Advisory
• https://t.me/cibsecurity/50387 · Telegram Post