CVE-2023-28316

CRITICAL

9.8

Descricao

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.

Detalhes CVE

Pontuacao CVSS v3.19.8

SeveridadeCRITICAL

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioNONE

Publicado5/9/2023

Ultima modificacao1/28/2025

Fontenvd

Avistamentos honeypot0

Produtos afetados

rocket.chat:rocket.chat

Fraquezas (CWE)

CWE-384CWE-384

Referencias

https://hackerone.com/reports/992280(support@hackerone.com)

https://hackerone.com/reports/992280(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.