What’s Vulnerable › Vulnerabilities
CVE-2023-23917
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-02-23 · updated 2026-10-24
- Weakness: CWE-77
Description
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.
Affected products
- Rocket.Chat: before 5.2.0 — fixed in 5.2.0
How to fix
Upgrade to a fixed version: Rocket.Chat 5.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2023-23917 or the next vulnerability affects your stack