CVE-2023-28325 — n/a / Rocket.Chat

Description (CNA)

An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.

Affected (CNA)

Vendor / product	Versions
n/a / Rocket.Chat	affected This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions

CWE

CWE-285

References

https://hackerone.com/reports/1406479

ADP enrichment

CVE

No English description supplied.

https://hackerone.com/reports/1406479

CISA-ADP

No English description supplied.

No references supplied.