CVE-2018-13878

2018-07-1101:29:01

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.5%

JSON

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

CPENameOperatorVersion
rocket.chateq0.47.1
rocket.chateq0.48.1
rocket.chateq0.63.0-rc.2
rocket.chateq0.56.0-rc.3
rocket.chateq0.56.0-rc.6
rocket.chateq0.60.4-rc.0
rocket.chateq0.59.0-rc.5
rocket.chateq0.39.0
rocket.chateq0.40.1
rocket.chateq0.54.2

Name	Operator	Version
rocket.chat	eq	0.47.1
rocket.chat	eq	0.48.1
rocket.chat	eq	0.63.0-rc.2
rocket.chat	eq	0.56.0-rc.3
rocket.chat	eq	0.56.0-rc.6
rocket.chat	eq	0.60.4-rc.0
rocket.chat	eq	0.59.0-rc.5
rocket.chat	eq	0.39.0
rocket.chat	eq	0.40.1
rocket.chat	eq	0.54.2

Rows per page:

1-10 of 1711

References

github.com/RocketChat/Rocket.Chat/pull/10793