Non notée
CVE-2021-22886 Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested…
Description
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Rocket.Chat | Versions non publiées |
Références
- docs.rocket.chat docs.rocket.chat
- hackerone.com hackerone.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Rocket.Chat
Les 26 CVE de Rocket.Chat →
CVE-2023-28325
An improper authorization vulnerability exists in…
6.5
Moyenne
CVE-2023-28357
A vulnerability has been identified in Rocket.Chat, where the ACL checks in the Slash Command /mute occur after checking…
4.3
Moyenne
CVE-2023-28356
A vulnerability has been identified where a maliciously crafted message containing a specific chain of characters can…
7.5
Élevée
CVE-2023-28359
A NoSQL injection vulnerability has been identified in the listEmojiCustom method call within Rocket.Chat
5.3
Moyenne