CVE-2022-32220 - AskarLabs CVE Database

CVE-2022-32220

Vendor N/A

Product Rocket.Chat

Weakness CWE-200 · Info exposure

Published September 23, 2022

Last update May 22, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.

Key dates

02Disclosure timeline

September 23, 2022 CVE published

May 22, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-32220 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html

Related vulnerabilities

04Related CVE

CVE-2023-34090 Decidim vulnerable to sensitive data disclosure CVE-2022-29241 Known or guessable hidden files may be accessed in Jupyter Server CVE-2022-36074 Authentication headers exposed on by Nextcloud Server CVE-2024-55946 Playloom Engine Data Storage Vulnerability CVE-2021-43938 Elcomplus SmartPTT SCADA Server Information Exposure