CVE-2021-22886CWE-79

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to…

published March 26, 2021

CVSS
—
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01885 · 79.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-03-26T18:15Z
EPSS history
Timeline
  • 26 MAR 18:15Z
    Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to…
    cvelistv5