7.5
CVE-2024-46936
- EPSS 0.4%
- Veröffentlicht 25.09.2024 01:15:44
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. Attackers can abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Herstellerrocketchat
≫
Produkt
rocket.chat
Default Statusunknown
Version
6.12.0
Version <
6.12.1
Status
affected
Version <=
6.11.2
Version
6.11.0
Status
affected
Version <=
6.10.5
Version
6.10.0
Status
affected
Version <=
6.9.6
Version
6.9.0
Status
affected
Version <=
6.8.6
Version
6.8.0
Status
affected
Version <=
6.7.8
Version
0
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.4% | 0.316 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
|
https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories
https://github.com/RocketChat/Rocket.Chat/pull/33246