Security readout for executives and security teams
Plain-English summary
Rocket.Chat servers on affected versions could reveal which channel members hold special roles to logged-in users who should not see that information. This is not a takeover bug, but it can expose sensitive membership and privilege context that may help profiling, targeting, or internal reconnaissance.
Executive priority
Treat as a routine but real confidentiality fix. Prioritize upgrade if Rocket.Chat hosts sensitive operations, executive channels, incident response rooms, or customer-specific workspaces.
Technical view
The issue is an information disclosure flaw in Rocket.Chat before v5, before 4.8.2, and before 4.7.5. The getRoomRoles Meteor method lacked ACL checks, allowing unauthorized authenticated clients to learn channel members with special roles. CVSS is 4.3: network reachable, low complexity, privileges required, confidentiality impact only.
Likely exposure
Exposure is most relevant to organizations running Rocket.Chat versions earlier than the fixed releases, especially instances with private channels, sensitive role assignments, or broad user access.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. The vulnerability requires authenticated access and leaks role-related channel membership data rather than enabling direct code execution or service disruption.
Researcher notes
Evidence is limited to the CVE description and HackerOne reference in the bundle. The described root cause is missing ACL enforcement in getRoomRoles, with unauthorized authenticated clients receiving special-role membership information. No exploit details or active exploitation evidence are provided.
Mitigation direction
- Inventory Rocket.Chat versions across all hosted and self-managed instances.
- Upgrade affected deployments to the fixed Rocket.Chat versions named by the CVE sources.
- Review Rocket.Chat vendor guidance for branch-specific upgrade instructions.
- Restrict account access where possible until affected systems are upgraded.
- Monitor for unusual role or room metadata access patterns.
Validation and detection
- Confirm each Rocket.Chat instance version is 4.7.5, 4.8.2, 5.0.0, or otherwise vendor-confirmed fixed.
- Check whether sensitive channels use special roles that would increase disclosure impact.
- Review authentication scope and user population on affected instances.
- Confirm no unsupported or untracked Rocket.Chat deployments remain online.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-35247 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://hackerone.com/reports/1447440CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.