CVE-2023-28357 — n/a / Rocket.Chat

Description (CNA)

A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking whether a user is a member of a given channel, leaking private channel members to unauthorized users. This allows authenticated users to enumerate whether a username is a member of a channel that they do not have access to.

Affected (CNA)

Vendor / product	Versions
n/a / Rocket.Chat	affected This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions

CWE

CWE-200

References

https://hackerone.com/reports/1445810

ADP enrichment

CVE

No English description supplied.

https://hackerone.com/reports/1445810

CISA-ADP

No English description supplied.

No references supplied.