CVE-2023-28316

CRITICAL

9.8

Description

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie5/9/2023

Derniere modification1/28/2025

Sourcenvd

Observations honeypot0

Produits affectes

rocket.chat:rocket.chat

Faiblesses (CWE)

CWE-384CWE-384

References

https://hackerone.com/reports/992280(support@hackerone.com)

https://hackerone.com/reports/992280(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.