What is CVE-2023-28359?

CVE-2023-28359 is a medium-severity vulnerability in Rocket.chat, classified under SQL Injection. CVSS score: 5.3/10. Published 2023-05-11.

How severe is CVE-2023-28359?

Medium severity. CVSS v3 base score is 5.3 out of 10.

SQL Injection in Rocket.chat

CVE-2023-28359

A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat. This can be exploited by unauthenticated users when there is at least one custom emoji uploaded to the Rocket.Chat instance. The vulnerability causes a delay in the server response, with the potential for limited impact.

Vulnerability class: SQL Injection

EPSS: 0.006 (46.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Rocket.chat
N/a Rocket.chat — versions This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions

Weakness classification (CWE)

CWE-89 — SQL Injection

References

support@hackerone.com (Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2023-28359?: CVE-2023-28359 is a medium-severity vulnerability in Rocket.chat, classified under SQL Injection. CVSS score: 5.3/10. Published 2023-05-11.
How severe is CVE-2023-28359?: Medium severity. CVSS v3 base score is 5.3 out of 10.