Описание
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
Ссылки
- Third Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1
cpe:2.3:a:rocket.chat:rocket.chat:-:*:*:*:*:*:*:*
EPSS
Процентиль: 53%
0.00305
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-384
CWE-384
Связанные уязвимости
CVSS3: 9.8
github
больше 2 лет назад
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
EPSS
Процентиль: 53%
0.00305
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-384
CWE-384