An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
| Link | Tags |
|---|---|
| https://trovent.io/security-advisory-2010-01 | third party advisory exploit |
| http://www.openwall.com/lists/oss-security/2021/01/07/1 | mailing list exploit third party advisory |
| http://packetstormsecurity.com/files/160845/Rocket.Chat-3.7.1-Email-Address-Enumeration.html | exploit vdb entry third party advisory |
| http://www.openwall.com/lists/oss-security/2021/01/08/1 | mailing list exploit third party advisory |
| https://trovent.github.io/security-advisories/TRSA-2010-01/TRSA-2010-01.txt | third party advisory exploit |
| http://seclists.org/fulldisclosure/2021/Jan/32 | mailing list third party advisory broken link |
| http://www.openwall.com/lists/oss-security/2021/01/13/1 | mailing list exploit third party advisory |
| http://seclists.org/fulldisclosure/2021/Jan/43 | mailing list third party advisory broken link |