CVE-2023-28325
Published: 11 May 2023
Summary
CVE-2023-28325 is a medium-severity Improper Authorization (CWE-285) vulnerability in Rocket.Chat Rocket.Chat. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 44.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32032
Vulnerability details
An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Auditing session actions allows identification of improper authorization decisions and enforcement failures.
Identity providers centralize and enforce authentication mechanisms, reducing improper authentication.
Enforces correct authorization checks during the identifier assignment process.
Procedures define authorization decisions tied to hiring, transfer, and termination, reducing the likelihood of improper authorization decisions.
Decoys identify and block exploitation of improper authorization by providing monitored targets that mimic protected functions.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.