Improper Access Control in Chat Room Software by Vendor X
CVE-2023-23911

7.5HIGH

Key Information:

Vendor

Rocket.chat

Status
Rocket.chat
Vendor
CVE Published:
10 March 2023

What is CVE-2023-23911?

An improper access control vulnerability has been identified in the chat room software before version 6. This security flaw could allow an unauthorized user to manipulate the group key used for end-to-end (E2E) encryption, enabling them to potentially gain access to encrypted messages and disrupt chat room integrity. Organizations utilizing this software are advised to review their security measures and update to the latest version to mitigate this risk.

Affected Version(s)

Rocket.Chat fixed version => 6.0

References

https://hackerone.com/reports/1757663

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.