CVE-2023-28358mediumCWE-79

CVE-2023-28358: medium-severity vulnerability in Rocket.Chat

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · Rocket.Chat
References
https://hackerone.com/reports/1781131