Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.
References
| Link | Resource |
|---|---|
| https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories | Release Notes |
| https://github.com/RocketChat/Rocket.Chat/pull/33246 | Patch |
Configurations
Configuration 1 (hide)
|
History
26 Sep 2024, 17:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories - Release Notes | |
| References | () https://github.com/RocketChat/Rocket.Chat/pull/33246 - Patch | |
| CPE | cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc6:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc1:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc3:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc2:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc5:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc4:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:-:*:*:*:*:*:* cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* |
|
| First Time |
Rocket.chat rocket.chat
Rocket.chat |
|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
26 Sep 2024, 13:32
| Type | Values Removed | Values Added |
|---|---|---|
| Summary |
|
25 Sep 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-09-25 01:15
Updated : 2024-09-26 17:41
NVD link : CVE-2024-46934
Mitre link : CVE-2024-46934
CVE.ORG link : CVE-2024-46934
JSON object : View
Products Affected
rocket.chat
- rocket.chat
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')