CVE-2020-28208 (MEDIUM 5.3) · Watchpost

← All vulnerabilities

CVE-2020-28208

MEDIUM 5.3CVE-2020-28208 · Published 08/01/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
rocket.chat rocket.chat	`≤ 3.9.1`	No fix yet

Description

An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.

References

packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html · Exploit
seclists.org/fulldisclosure/2021/Jan/32 · Broken Link
seclists.org/fulldisclosure/2021/Jan/43 · Broken Link
openwall.com/lists/oss-security/2021/01/07/1 · Exploit
openwall.com/lists/oss-security/2021/01/08/1 · Exploit
openwall.com/lists/oss-security/2021/01/13/1 · Exploit
trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt · Exploit
trovent.io/security-advisory-2010-01 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free