« Volver al listado

CVE-2021-22892

Estado: ModificadaAlta (7.5)—

An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rocket.chat — Rocket.chat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-22892",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Rocket.Chat server",
          "versions": [
            {
              "status": "affected",
              "version": "Fixed versions: 3.13, 3.12.2, 3.11.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-05-27T12:15:07.883",
  "references": [
    {
      "url": "https://hackerone.com/reports/1089116",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://hackerone.com/reports/1089116",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-203"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability exists in the Rocket.Chat server fixed v3.13, v3.12.2 & v3.11.3 that allowed email addresses to be disclosed by enumeration and validation checks."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de divulgación de información en el servidor Rocket.Chat corregido en versiones v3.13, v3.12.2 y v3.11.3, que permitía que las direcciones de correo electrónico sean divulgadas mediante comprobaciones de enumeración y validación"
    }
  ],
  "lastModified": "2026-06-17T03:37:57.840",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "884F0825-B932-403D-A419-626F8B3C1AA4",
              "versionEndExcluding": "3.11.3"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F568464-264D-4269-8979-12FD1BB17F73",
              "versionEndExcluding": "3.12.2",
              "versionStartIncluding": "3.12.0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:3.12.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "452B86C4-9344-4D05-93D9-6AE0A288D740"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:3.12.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECA25358-3CA9-4991-AA53-01EBCBFE46B0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:3.12.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "863DA436-E21C-45CD-9D26-A52A475C701B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}