medium6.5
CVE-2023-28325
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage metho…
Impact
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | before 6.0.0 |