Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-39713 · ADVISORY
• RocketChat/Rocket.Chat commit ce072a1 · WEB
• hackerone.com/reports/1886954 · WEB
• RocketChat/Rocket.Chat · PACKAGE

rocket.chat のその他の脆弱性

• CVE-2026-65645中 4.3Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList an…
• CVE-2026-65644高 7.5Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/live…
• CVE-2026-58066緊急 9.8Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did n…
• CVE-2026-48929高 7.5Rocket.Chat in versions <8.5.1, <8.4.4, <8.3.6, <8.2.6, <8.1.6, <8.0.7, <7.13.9, and <7.10.13 is vulnerable to unauthenticated file deletion…
• CVE-2026-48616緊急 9.3Rocket.Chat versions <8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. Prote…