Information Disclosure Vulnerability in Rocket.Chat Server by Rocket.Chat
CVE-2021-22892

7.5HIGH

Key Information:

Vendor

Rocket.chat

Status
Rocket.chat Server
Vendor
CVE Published:
27 May 2021

What is CVE-2021-22892?

An information disclosure vulnerability exists in the Rocket.Chat server that permits attackers to exploit enumeration and validation checks, potentially exposing sensitive email addresses. The issue has been addressed in versions v3.13, v3.12.2, and v3.11.3, highlighting the importance of regular updates to protect against such vulnerabilities.

Affected Version(s)

Rocket.Chat server Fixed versions: 3.13, 3.12.2, 3.11.3

References

https://hackerone.com/reports/1089116
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.