SQL Injection Vulnerability in Rocket.Chat Products by Rocket.Chat

CVE-2022-32211

What is CVE-2022-32211?

A SQL injection vulnerability in Rocket.Chat allows attackers to exploit poorly sanitized user inputs, potentially leading to unauthorized access. Attackers can retrieve sensitive information, such as reset password tokens or two-factor authentication (2FA) secrets, from affected versions of the software, namely those below 3.18.6, 4.4.4, and 4.7.3. Organizations using these affected versions should prioritize applying security patches to mitigate possible exploitation.

References