PT-2024-31711
CVE-2024-45621
·
تاريخ النشر
2024-09-02
·
تاريخ التحديث
2025-11-07
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions:
Rocket.Chat versions through 6.3.4
Description:
The Electron desktop application of Rocket.Chat allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents. This issue can compromise user sessions.
Recommendations:
For versions through 6.3.4, update to a version later than 6.3.4 to resolve the issue. As a temporary workaround, consider restricting the upload of files that may contain links to mitigate the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾