Rocket.chat: Security Vulnerabilities
Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.
CVSS Score
6.1
EPSS Score
0.005
Published
2021-03-26
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
CVSS Score
5.4
EPSS Score
0.005
Published
2021-01-26
Rocket.Chat server before 3.9.0 is vulnerable to a self cross-site scripting (XSS) vulnerability via the drag & drop functionality in message boxes.
CVSS Score
5.4
EPSS Score
0.003
Published
2021-01-26
An email address enumeration vulnerability exists in the password reset function of Rocket.Chat through 3.9.1.
CVSS Score
5.3
EPSS Score
0.468
Published
2021-01-08
Rocket.Chat before 0.74.4, 1.x before 1.3.4, 2.x before 2.4.13, 3.x before 3.7.3, 3.8.x before 3.8.3, and 3.9.x before 3.9.1 mishandles SAML login.
CVSS Score
9.8
EPSS Score
0.004
Published
2020-12-30
Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.
CVSS Score
6.1
EPSS Score
0.009
Published
2020-08-18
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
CVSS Score
6.1
EPSS Score
0.026
Published
2019-10-21
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.
CVSS Score
6.1
EPSS Score
0.002
Published
2018-07-11
A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-07-11
Rocket.Chat Server version 0.59 and prior is vulnerable to a NoSQL injection leading to administrator account takeover
CVSS Score
9.8
EPSS Score
0.003
Published
2018-01-03