CVE-2023-23911
High
Description
An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a user changing the group key of a chat room.
SeverityHigh
CVSS7.5
Exploit probability17. percentile0.3%
Product
Rocket.chat
PublishedMar 10, 2023
First seenMar 10, 2023
Weakness typeCWE-284Improper access control
How to fix
Update
- rocket.chat rocket.chat6.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rocket.chat rocket.chat | v < 6.0.0 | 6.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.