CVE-2018-13879

{"id": "CVE-2018-13879", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2018-07-11T01:29:01.550", "references": [{"url": "https://github.com/RocketChat/Rocket.Chat/issues/10795", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html."}, {"lang": "es", "value": "Se ha descubierto un problema de Cross-Site Scripting (XSS) reflejado en el formulario de registro en Rocket.Chat en versiones anteriores a la 0.66. Cuando se crea una cuenta, el siguiente paso solicitar\u00e1 un nombre de usuario. Este campo no guardar\u00e1 los caracteres de control HTML, pero se mostrar\u00e1 un error que muestra el intento de nombre de usuario sin escapar mediante packages/rocketchat-ui-login/client/username/username.js en packages/rocketchat-ui-login/client/username/username.html."}], "lastModified": "2018-09-05T16:33:51.227", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A59E694D-0BDC-4337-B946-488E1E6E88A7", "versionEndExcluding": "0.66"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}