PT-2018-12246 · Rocket.Chat · Rocket.Chat

Erhan- · Publicado 2018-07-11 · Atualizado 2018-09-05 · CVE-2018-13878

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 0.65

Description A security issue was found in Rocket.Chat where the real name of a username is displayed unescaped when a user is mentioned in a channel or private chat. This allows for the exfiltration of the secret token of every user, including admins, in the channel.

Recommendations For versions prior to 0.65, update to version 0.65 or later to resolve the issue. As a temporary workaround, consider restricting the use of the @ symbol for mentions until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-13878

Produtos afetados

Rocket.Chat

Referências · 4

• https://github.com/RocketChat/Rocket.Chat/pull/10793 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-13878 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-13878 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13878 · Nota