QwikSec

Security Database

CVE

CWE

Training

CVE-2022-32228

Published: Sep 23, 2022

Modified: May 22, 2025

PUBLISHED

Description

An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter user inputs that are passed to MongoDB queries, allowing $regex queries to enumerate arbitrary Message IDs.

Vendor	Product	Versions
n/a	Rocket.Chat	affected `Fixed in versions 4.7.5, 4.8.2 and 5.0.0`

Weaknesses (CWE)

References

https://hackerone.com/reports/1377105

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.