地图 / The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.

The initial E2EE password generated by Rocket.Chat mobile can be recovered in a practical timescale.

密码学缺陷 / Use of Insufficiently Random Values / #2546437

厂商: Rocket.Chat
严重程度: 中危 · CVSS 7.2
赏金: —
弱点: Use of Insufficiently Random Values
研究员: @h0011
披露日期: 2024-10-01
资产: https://github.com/RocketChat/Rocket.Chat.ReactNative
CVE: CVE-2024-42027

该报告还没有中文解读。

时间线

2024-06-11报告提交
2024-10-01公开披露

阅读 HackerOne 原文 ↗作者 @h0011 · 版权归作者与 Rocket.Chat 所有

同类报告

Invite tokens have Insufficient entropy in GHES Management ConsoleGitHub · 2024-01-12 on the implications of permitting procedural cullingcurl · 2025-07-22 Predictable proposal participant tokens enable unauthorized access and vote submissionNextcloud · 2026-01-04 · $100 Usage of unsafe random function in undici for choosing boundaryNode.js · 2025-01-23