CVE-2024-37405

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.

Score

CVSS 3.0 6.5 Medium

Status

Deferred - support@hackerone.com

Published

2024-07-12

Last modified

2024-08-02

Weaknesses

CWE-94

Affected products

• Rocket.chat (Rocket.chat)

References

• https://hackerone.com/reports/2580062