What is CVE-2023-28316?

CVE-2023-28316 is a critical-severity vulnerability in Rocket.chat, classified under Session Fixation. CVSS score: 9.8/10. Published 2023-05-09.

How severe is CVE-2023-28316?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Rocket.chat

CVE-2023-28316

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.

EPSS: 0.007 (50.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Rocket.chat
N/a Rocket.chat — versions Fixed in 6.0> and back-ported accordingly to our supported versions. Check https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions for more info

Weakness classification (CWE)

CWE-384 — Session Fixation

References

support@hackerone.com (Third Party Advisory)

Frequently asked questions

What is CVE-2023-28316?: CVE-2023-28316 is a critical-severity vulnerability in Rocket.chat, classified under Session Fixation. CVSS score: 9.8/10. Published 2023-05-09.
How severe is CVE-2023-28316?: Critical severity. CVSS v3 base score is 9.8 out of 10.