« Volver al listado

CVE-2024-46936

Estado: AplazadaAlta (7.5)—

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. Attackers can abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Rocket.chat — Rocket.chatAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46936",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-46936",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-25T17:14:43.550066Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:rocketchat:rocket.chat:*:*:*:*:*:*:*:*"
          ],
          "vendor": "rocketchat",
          "product": "rocket.chat",
          "versions": [
            {
              "status": "affected",
              "version": "6.12.0",
              "lessThan": "6.12.1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "6.11.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.11.2"
            },
            {
              "status": "affected",
              "version": "6.10.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.10.5"
            },
            {
              "status": "affected",
              "version": "6.9.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.9.6"
            },
            {
              "status": "affected",
              "version": "6.8.0",
              "versionType": "custom",
              "lessThanOrEqual": "6.8.6"
            },
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "6.7.8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-25T01:15:44.700",
  "references": [
    {
      "url": "https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/RocketChat/Rocket.Chat/pull/33246",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. Attackers can abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose."
    },
    {
      "lang": "es",
      "value": "Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8 y versiones anteriores es vulnerable a un problema de falsificación o suplantación de identidad de mensajes. Los atacantes pueden abusar del método UpdateOTRAck para enviar mensajes efímeros como si fueran cualquier otro usuario que elijan."
    }
  ],
  "lastModified": "2026-06-17T07:56:13.363",
  "sourceIdentifier": "cve@mitre.org"
}