CVE-2023-28325
Last modified
CVE-2023-28325 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | < 6.0.0 |
References
- https://hackerone.com/reports/1406479Issue Tracking, Third Party Advisory
- https://hackerone.com/reports/1406479Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-28325?
How severe is CVE-2023-28325?
How do I fix CVE-2023-28325?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-2832 SQL Injection in GitHub repository unilogies/bumsys prior t…7.2
- CVE-2023-28320A denial of service vulnerability exists in curl <v8.1.0 in …5.9
- CVE-2023-28321An improper certificate validation vulnerability exists in c…5.9
- CVE-2023-28322An information disclosure vulnerability exists in curl <v8.1…3.7
- CVE-2023-28323A deserialization of untrusted data exists in EPM 2022 Su3 a…9.8
- CVE-2023-28324A improper input validation vulnerability exists in Ivanti E…9.8
- CVE-2023-28326Vendor: The Apache Software Foundation Versions Affected: A…9.8
- CVE-2023-28327A NULL pointer dereference flaw was found in the UNIX protoc…5.5
- CVE-2023-28328A NULL pointer dereference flaw was found in the az6027 driv…5.5
- CVE-2023-28329Insufficient validation of profile field availability condit…8.8
- CVE-2023-2833The ReviewX plugin for WordPress is vulnerable to privilege …8.8
- CVE-2023-28330Insufficient sanitizing in backup resulted in an arbitrary f…6.5
Are you affected by CVE-2023-28325?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST