Dashboard / CVE-2023-23917

CVE-2023-23917

HIGH
MEDIUM Priority: 0.09 BB Relevance: 68/100
Published: 2023-02-23 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastructure. This attack vector also may increase the impact of XSS to RCE which is dangerous for self-hosted users as well.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
rocket.chat rocket.chat < 5.2.0

References & Advisories (1)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.98%
Raw Score 0.009780
Percentile 62.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00978
2026-10-28
0.00978

Intelligence Sources

nvd ref →

External Links