| Package | Affected versions | Patched versions |
|---|---|---|
| rocket.chat | < 4.7.5 | 4.7.5 |
An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Users.find(queryFromClientSide). This means virtually any authenticated user can access any data (except password hashes) of any user authenticated.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free