PT-2022-22655 · Unknown · Rocket.Chat

Gronke · Published 2022-09-23 · Updated 2024-02-13 · CVE-2022-35248

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 5 Rocket.Chat versions prior to 4.8.2 Rocket.Chat versions prior to 4.7.5

Description A improper authentication issue exists that allows two-factor authentication to be bypassed when the server is configured to use CAS during login.

Recommendations For versions prior to 5, update to version 5 or later to resolve the issue. For versions prior to 4.8.2, update to version 4.8.2 or later to resolve the issue. For versions prior to 4.7.5, update to version 4.7.5 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-35248

Affected Products

Rocket.Chat

References · 3

• 🔥 https://hackerone.com/reports/1448268 · Exploit
• https://osv.dev/vulnerability/CVE-2022-35248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35248 · Security Note