CVE-2022-35246

A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat

Description d'origine

La description telle que publiée par la source (souvent en anglais).

A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Références

advisory github.com
advisory nvd.nist.gov
web hackerone.com

Métadonnées

CVE: CVE-2022-35246
Publication: 2022-09-23
Première détection SecPulse: il y a 4 ans
Source initiale: OSV.dev (Open Source Vulnerabilities)

CWE

CWE-200

Sources de détection

OSV.dev (Open Source Vulnerabilities) il y a 2 mois