ID CVE-2018-13878
Summary An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.
References
Vulnerable Configurations
CVSS
Base: None
Impact:
Exploitability:
Last major update 10-07-2018 - 21:29
Published 10-07-2018 - 21:29
Last modified 10-07-2018 - 21:29
Back to Top