Bypassing Two-Factor Authentication in Rocket.Chat via CAS Login Vulnerability

CVE-2022-35248 · HIGH Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.

Learn more about our Cis Benchmark Audit For Server Software.