Advertisement






Rocket.Chat Cross Site Scripting

CVE Category Price Severity
CVE-2020-14923 CWE-79 $5,000 High
Author Risk Exploitation Type Date
Rafay Baloch High Remote 2020-12-19
CVSS EPSS EPSSP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L 0 0

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2020120139

Below is a copy:

Rocket.Chat Cross Site Scripting
Rocket.Chat has quietly fixed a stored XSS vulnerability in the following
commits:

https://github.com/RocketChat/Rocket.Chat/commit/96d3155245ec65f681664b48b6dafc94c1ea021c
https://github.com/RocketChat/Rocket.Chat/commit/43fe12d775b2329e780a1369a1b2c25070cdcab9

Exploitation of this vulnerability is very straightforward by manipulating
a message attachment to contain a XSS payload either in the type or the
body.

No release of Rocket.Chat contains these fixes. Users should consider
cherrypicking 96d3155245ec65f681664b48b6dafc94c1ea021c
and 43fe12d775b2329e780a1369a1b2c25070cdcab9 to patch their Rocket.Chat
installation.

Moe


Copyright ©2024 Exploitalert.

This information is provided for TESTING and LEGAL RESEARCH purposes only.
All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum