Security Advisory

CVE-2018-13878

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-07-11 01:00:00

Last updated 2024-09-17 01:20:43

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

← Browse all CVEs View on cve.org ↗