CVE-2020-28208

An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

• CWE-203

• http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Jan/32Broken Link, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Jan/43Broken Link, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/07/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/08/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/13/1Exploit, Mailing List, Third Party Advisory
• https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txtExploit, Third Party Advisory
• https://trovent.io/security-advisory-2010-01Exploit, Third Party Advisory
• http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Jan/32Broken Link, Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2021/Jan/43Broken Link, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/07/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/08/1Exploit, Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/01/13/1Exploit, Mailing List, Third Party Advisory
• https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txtExploit, Third Party Advisory
• https://trovent.io/security-advisory-2010-01Exploit, Third Party Advisory

Published

Jan 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28198The 'id' parameter of IBM Tivoli Storage Manager Version 5 R…7
• CVE-2020-28199best it Amazon Pay Plugin before 9.4.2 for Shopware exposes …9.1
• CVE-2020-2820Vulnerability in the Oracle Common Applications Calendar pro…8.2
• CVE-2020-28200The Sieve engine in Dovecot before 2.3.15 allows Uncontrolle…4.3
• CVE-2020-28203An issue was discovered in Foxit Reader and PhantomPDF 10.1.…5.5
• CVE-2020-28206An issue was discovered in Bitrix24 Bitrix Framework (1c sit…6.5
• CVE-2020-28209A CWE-428 Windows Unquoted Search Path vulnerability exists …7
• CVE-2020-2821Vulnerability in the Oracle Trade Management product of Orac…8.2
• CVE-2020-28210A CWE-79 Improper Neutralization of Input During Web Page Ge…6.1
• CVE-2020-28211A CWE-863: Incorrect Authorization vulnerability exists in P…7.8
• CVE-2020-28212A CWE-307: Improper Restriction of Excessive Authentication …9.8
• CVE-2020-28213A CWE-494: Download of Code Without Integrity Check vulnerab…8.8