CVE-2023-28316
Last modified
CVE-2023-28316 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | All versions |
References
- https://hackerone.com/reports/992280Third Party Advisory
- https://hackerone.com/reports/992280Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28316?
How severe is CVE-2023-28316?
How do I fix CVE-2023-28316?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-2831Mattermost fails to unescape Markdown strings in a memory-ef…6.5
- CVE-2023-28310Microsoft Exchange Server Remote Code Execution Vulnerabilit…8
- CVE-2023-28311Microsoft Word Remote Code Execution Vulnerability7.8
- CVE-2023-28312Azure Machine Learning Information Disclosure Vulnerability6.5
- CVE-2023-28313Microsoft Dynamics 365 Customer Voice Cross-Site Scripting V…6.1
- CVE-2023-28314Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vu…6.1
- CVE-2023-28317A vulnerability has been discovered in Rocket.Chat, where ed…5.3
- CVE-2023-28318A vulnerability has been discovered in Rocket.Chat, where me…5.3
- CVE-2023-28319A use after free vulnerability exists in curl <v8.1.0 in the…7.5
- CVE-2023-2832 SQL Injection in GitHub repository unilogies/bumsys prior t…7.2
- CVE-2023-28320A denial of service vulnerability exists in curl <v8.1.0 in …5.9
- CVE-2023-28321An improper certificate validation vulnerability exists in c…5.9
Are you affected by CVE-2023-28316?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST