A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission view-full-other-user-info, this could cause an oauth token leak in the product.
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rocket.chat | Rocket.chat | * | 4.7.5 (excluding) |
| Rocket.chat | Rocket.chat | 4.8.0 (including) | 4.8.2 (excluding) |