PT-2024-22768 · Rocket.Chat+1 · Rocket.Chat.Audit+1

Published 2024-03-17 · Updated 2024-08-13 · CVE-2024-29151

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat.Audit through 5ad78e8

Description The issue arises because Rocket.Chat.Audit depends on filecachetools, which is not available in PyPI. This situation may lead to potential security risks due to the missing dependency.

Recommendations For Rocket.Chat.Audit through 5ad78e8, consider removing or replacing the dependency on filecachetools to mitigate potential risks until a proper fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2024-29151

Affected Products

Rocket.Chat.Audit

Filecachetools

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-29151 · Security Note
• https://github.com/RocketChat/Rocket.Chat.Audit/blob/5ad78e8017a9e190602e8257c22500ded0d931a9/requirements.txt#L3 · Note
• https://twitter.com/CVEnew/status/1769599728482697611 · Twitter Post
• https://twitter.com/Tedsig42/status/1769709172675825688 · Twitter Post
• https://t.me/cvenotify/74126 · Telegram Post
• https://t.me/cvenotify/90332 · Telegram Post
• https://twitter.com/RedPacketSec/status/1771841412570497303 · Twitter Post