CVE-2023-28316 Vulnerability Details

  /     /     /  

CVE-2023-28316 Metadata Quick Info

CVE Published: 09/05/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: hackerone | Vendor: n/a | Product: Rocket.Chat
Status : PUBLISHED

---

CVE-2023-28316 Description

A security vulnerability has been discovered in the implementation of 2FA on the rocket.chat platform, where other active sessions are not invalidated upon activating 2FA. This could potentially allow an attacker to maintain access to a compromised account even after 2FA is enabled.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-384
CWE Name: Session Fixation (CWE-384)
Source: n/a

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).