Description
Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12, in the visitors.info endpoint, https://developer.rocket.chat/apidocs/get-visitor-information-by-id-1, token is returned in the response. It looks like there's no use case for the token to be present in the response and it would be a good security practice to remove it altogether. This vulnerability is fixed in 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
RocketChat Rocket.Chat
>= 8.5.0-rc.0, < 8.5.0affected>= 8.4.0-rc.0, < 8.4.2affected>= 8.3.0-rc.0, < 8.3.4affected>= 8.2.0-rc.0, < 8.2.4affected>= 8.1.0-rc.0, < 8.1.5affected>= 8.0.0-rc.0, < 8.0.6affected>= 7.11.0-rc.0, < 7.13.8affected< 7.10.12affected