CVE-2023-23917

State: Published
Severity: 8.8 High
Published: Feb 23, 2023
Updated: Mar 12, 2025
Reserved: Jan 19, 2023

Description

A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-77 Command Injection - Generic (CWE-77)
CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected Products

Product	Versions
Rocket.chatn/a	Fixed Version => 5.2.0Affected

References

https://hackerone.com/reports/1631258

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.