CVE-2023-28316 Security feature bypass in Rocket.Chat
Attackers can retain access to compromised accounts after 2FA activation because existing sessions are not invalidated, requiring a patch to secure session management.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28316?
CVE-2023-28316 is a critical vulnerability in Rocket.chat Rocket.chat, published on 9 May 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.
Weakness: CWE-384
Which versions are affected by CVE-2023-28316?
It affects 1 product.
Products include Rocket.chat Rocket.chat.
How do I fix CVE-2023-28316?
No fix has been published for CVE-2023-28316 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28316 being exploited?
There is no known exploitation of CVE-2023-28316 in the wild and no public exploit code.
Other vulnerabilities in Rocket.chat Rocket.chat
Sources
Also known as GHSA-fm4w-5hqf-ch9w.