CVE-2023-23917

8.8 Élevée

Publiée le 23/02/2023 à 21:15 · Modifiée le 24/10/2026 à 15:10 · Modifiée · Source : support@hackerone.com

Description

A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.

Traduire en français

Produits concernés

Rocket.chat
Rocket.chat rocket.chat

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.8 Élevée	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	8.8 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-77
CWE-1321

Références

https://hackerone.com/reports/1631258 Permissions Required
https://hackerone.com/reports/1631258 Permissions Required

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories