Vulnerability · Published Aug 30, 2021 · Assigned by GitHub_M
CVE-2021-32832ReDOS in Rocket.Chat
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in Rocket.Chat from RocketChat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)1.6%top 23.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Rocket.Chat is an open-source fully customizable communications platform developed in JavaScript. In Rocket.Chat before versions 3.11.3, 3.12.2, and 3.13 an issue with certain regular expressions could lead potentially to Denial of Service. This was fixed in versions 3.11.3, 3.12.2, and 3.13.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| RocketChat | Rocket.Chat | < 3.11.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
References
- https://docs.rocket.chat/guides/security/security-updates x_refsource_MISC
- https://securitylab.github.com/advisories/GHSL-2020-310-redos-Rocket.Chat/ x_refsource_CONFIRM
- https://github.com/RocketChat/Rocket.Chat/releases/tag/3.11.3 x_refsource_MISC
- https://github.com/RocketChat/Rocket.Chat/commit/4a0dce973e37ec3f56ca2231d6030511dbdd094c x_refsource_MISC