PT-2018-12247 · Rocket.Chat · Rocket.Chat

Erhan- · Publicado 2018-07-11 · Atualizado 2018-09-05 · CVE-2018-13879

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 0.66

Description A reflected XSS issue was found in the registration form. When creating an account, the username field does not save HTML control characters, but an error message displays the attempted username unescaped. This issue is related to the username.js file in packages/rocketchat-ui-login/client/username/ and the username.html file in the same directory.

Recommendations For versions prior to 0.66, update to version 0.66 or later to resolve the issue. As a temporary workaround, consider restricting access to the registration form to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-13879

Produtos afetados

Rocket.Chat

Referências · 3

• https://github.com/RocketChat/Rocket.Chat/issues/10795 · Nota
• https://osv.dev/vulnerability/CVE-2018-13879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13879 · Nota de Segurança