Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

Rocket.Chat Twilio Webhook Endpoint Allows Unintended Access

CVE-2024-39713 · published 2 years ago
Summary

Attackers can use Rocket.Chat's Twilio webhook to access unauthorized servers. This can allow hackers to exploit vulnerabilities in internal systems or disrupt service. Update to version 6.10.1 or later to protect your Rocket.Chat instance.

What to do
  • Update vps rocket.chat to version 6.10.1.
  • Update rocket.chat rocket.chat to version 6.10.1 or later.
Affected software
Ecosystem VendorProductAffected versions
npm vps rocket.chat < 6.10.1
Fix: upgrade to 6.10.1
– rocket.chat rocket.chat < 6.10.1
cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*
Original advisory text
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
3% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published5 Aug 2024
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-ffxg-5f8m-h72j · GHSA
CVE-2024-39713 · NVD
CVE-2024-39713 · OSV
Track software like this
Free during beta