CVE-2022-35248

HIGH

Rocket.Chat < 4.7.5 - Two-Factor Authentication Bypass via CAS Login

Title source: llm

Description

A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.

References (1)

Core 1

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/1448268

Scores

CVSS v3 8.8

EPSS 0.0122

EPSS Percentile 64.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (1)

rocket.chat/rocket.chat < 4.7.5

Published Sep 23, 2022

Tracked Since Feb 18, 2026