CVE-2021-22911

Опубликовано: 27 мая 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Критический

Описание

A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.

Ссылки

http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://blog.sonarsource.com/nosql-injections-in-rocket-chat
Exploit
Third Party Advisory
https://hackerone.com/reports/1130721
Exploit
Third Party Advisory
http://packetstormsecurity.com/files/162997/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/163419/Rocket.Chat-3.12.1-NoSQL-Injection-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://blog.sonarsource.com/nosql-injections-in-rocket-chat
Exploit
Third Party Advisory
https://hackerone.com/reports/1130721
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rocket.chat:rocket.chat:3.11.0:-:*:*:*:*:*:*

cpe:2.3:a:rocket.chat:rocket.chat:3.12.0:-:*:*:*:*:*:*

cpe:2.3:a:rocket.chat:rocket.chat:3.13.0:-:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.92332

Критический

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-75

NVD-CWE-Other

Связанные уязвимости

GHSA-fj2w-2856-965h