Medium · 6.5 CVE-2024-37405 EUVD-2024-36639GHSA-gxww-73x5-rvc2

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHis…

Published Jul 12, 2024 · Updated Aug 2, 2024 · Assigned by hackerone

Description

Livechat messages can be leaked by combining two NoSQL injections affecting livechat:loginByToken (pre-authentication) and livechat:loadHistory.

Vendor	Product	Affected	Fixed
Rocket.Chat	Rocket.Chat	6.10.0 – < 6.10.0	6.10.0