CVE-2021-22910 | BDVDB-2026-158376 Detail

Rocket.Chat server

Description#

A sanitization vulnerability exists in Rocket.Chat server versions <3.13.2, <3.12.4, <3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)

References#

https://hackerone.com/reports/1130874
https://blog.sonarsource.com/nosql-injections-in-rocket-chat/

Exploit#

No public exploit known

History#

Version 12021-08-09Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.