CVE-2021-22886

2021-03-2618:15:54

CWE-79

hackerone

www.cve.org

rocket.chat

persistent xss

remote code execution

EPSS

0.001

Percentile

43.0%

JSON

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

CNA Affected

[
  {
    "product": "Rocket.Chat ",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 3.11, 3.10.5, 3.9.7, 3.8.8"
      }
    ]
  }
]