CVE-2023-28325

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

An improper authorization vulnerability exists in Rocket.Chat <6.0 that could allow a hacker to manipulate the rid parameter and change the updateMessage method that only checks whether the user is allowed to edit message in the target room.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-285 CWE-287 CWE-863

Affected software

Vendor	Product	Versions
n/a	Rocket.Chat	This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions

References

https://hackerone.com/reports/1406479Issue Tracking, Third Party Advisory
https://hackerone.com/reports/1406479Issue Tracking, Third Party Advisory

Timeline

Published: May 11, 2023
Last modified: Oct 24, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-283269.8Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate th CVE-2023-283275.5A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allo CVE-2023-283285.5A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from u CVE-2023-283298.8Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and CVE-2023-28338.8The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restrict CVE-2023-283306.5Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teache CVE-2023-283316.1Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.CVE-2023-283326.1If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.CVE-2023-283339.8The Mustache pix helper contained a potential Mustache injection risk if combined with user input (note: This did not appear to be implement CVE-2023-283344.3Authenticated users were able to enumerate other users' names via the learning plans page.CVE-2023-283358.8The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk.CVE-2023-283364.3Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.