PT-2018-12246 · Rocket.Chat · Rocket.Chat

Erhan- · Published 2018-07-11 · Updated 2018-09-05 · CVE-2018-13878

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 0.65

Description A security issue was found in Rocket.Chat where the real name of a username is displayed unescaped when a user is mentioned in a channel or private chat. This allows for the exfiltration of the secret token of every user, including admins, in the channel.

Recommendations For versions prior to 0.65, update to version 0.65 or later to resolve the issue. As a temporary workaround, consider restricting the use of the @ symbol for mentions until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-13878

Affected Products

Rocket.Chat

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-13878 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13878 · Vendor Advisory
• https://github.com/RocketChat/Rocket.Chat/pull/10793 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13878 · Note