Vulnerability identifier: #VU38701
Vulnerability risk: Low
CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-79
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Rocket.Chat
Web applications /
Forum & blogging software
Vendor: Rocket.Chat Technologies Corp.
Description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Rocket.Chat: 0.8.0 - 0.57.2
External links
http://www.theblazehen.com/posts/CVE-2017-xxxxxx-rocketchat-xss-with-markdown-url-handling-in-messages/
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.