Description
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Rocket.Chat <3.9.1 - Information Disclosure http/cves/2020/CVE-2020-28208.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://trovent.io/security-advisory-2010-01
- [oss-security] 20210107 Trovent Security Advisory 2010-01 / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability mailing-list
- http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html
- [oss-security] 20210108 Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability mailing-list
- https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt
- 20210112 Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability mailing-list
- [oss-security] 20210113 Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability mailing-list
- 20210119 Re: Trovent Security Advisory 2010-01 [updated] / CVE-2020-28208: Rocket.Chat email address enumeration vulnerability mailing-list