XSS Vulnerability in Rocket.Chat Web Application by Rocket.Chat
CVE-2020-8291

6.1MEDIUM

Key Information:

Vendor

Rocket.chat

Status
Rocket.chat Server
Vendor
CVE Published:
18 October 2021

What is CVE-2020-8291?

A security flaw in Rocket.Chat versions prior to 3.9 involves improper rendering of link previews, allowing for potential Cross-Site Scripting (XSS) attacks. This vulnerability can enable attackers to inject malicious scripts into unsuspecting users' browsers when they interact with crafted link previews, posing significant risks to user data integrity and application security. It is crucial for users to update to the latest version to mitigate these risks.

Affected Version(s)

Rocket.Chat server Fixed versions: 3.10, 3.9.4, 3.8.5

References

https://github.com/RocketChat/Rocket.Chat/pull/19854
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.