CVE-2023-28358

Published May 11, 2023

Last updated a year ago

CVSS medium 6.1

Overview

Description: A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
Source: support@hackerone.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-79
support@hackerone.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2B1141C6-65B5-4FC0-8E0C-C8162E3FDD73",
            "versionEndExcluding": "6.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References