2FA Session Management Flaw in Rocket.Chat by Rocket.Chat Technologies
CVE-2023-28316

9.8CRITICAL

Key Information:

Vendor

Rocket.chat

Status
Rocket.chat
Vendor
CVE Published:
9 May 2023

What is CVE-2023-28316?

A security vulnerability has been discovered in Rocket.Chat's implementation of two-factor authentication (2FA). When users enable 2FA, the platform fails to properly invalidate other active sessions. This oversight allows an attacker to maintain access to a compromised account, posing a significant security risk. Users who activate 2FA may believe they are secure, not realizing that their previous sessions remain accessible. Prompt action is essential to secure accounts and mitigate potential breaches.

Affected Version(s)

Rocket.Chat Fixed in 6.0> and back-ported accordingly to our supported versions. Check https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions for more info

References

https://hackerone.com/reports/992280

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.