CVE-2022-32219

n/a / Rocket.Chat PUBLISHED

Description (CNA)

An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.

Affected (CNA)

Vendor / product	Versions
n/a / Rocket.Chat	affected fixed in 4.7.5>

CWE

CWE-200

References

https://hackerone.com/reports/1140631

ADP enrichment

CVE

No English description supplied.

https://hackerone.com/reports/1140631

CISA-ADP

No English description supplied.

No references supplied.