PT-2021-15254
CVE-2021-22886
·
تاريخ النشر
2021-03-26
·
تاريخ التحديث
2021-03-30
الوصف من
CVSS 3.1
6.1
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
Rocket.Chat versions prior to 3.11
Rocket.Chat version 3.10.5
Rocket.Chat version 3.9.7
Rocket.Chat version 3.8.8
Description
The issue allows a remote attacker to inject arbitrary JavaScript in a message using nested markdown tags, leading to persistent cross-site scripting (XSS). This flaw can result in arbitrary file read and remote code execution (RCE) on the Rocket.Chat desktop app.
Recommendations
For Rocket.Chat version 3.8.8, update to a version later than 3.8.8 to resolve the issue.
For Rocket.Chat version 3.9.7, update to a version later than 3.9.7 to resolve the issue.
For Rocket.Chat version 3.10.5, update to a version later than 3.10.5 to resolve the issue.
For Rocket.Chat versions prior to 3.11, update to version 3.11 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾