NoSQL-Injection Information Disclosure Vulnerability in Rocket.Chat
CVE-2022-35246 · MEDIUM Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
Learn more about our Cis Benchmark Audit For Microsoft Sql Server.