CVE-2023-28358 Vulnerability Details

  /     /     /  

CVE-2023-28358 Metadata Quick Info

CVE Published: 11/05/2023 | CVE Updated: 02/08/2024 | CVE Year: 2023
Source: hackerone | Vendor: n/a | Product: Rocket.Chat
Status : PUBLISHED

---

CVE-2023-28358 Description

A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-79
CWE Name: Cross-site Scripting (XSS) - Stored (CWE-79)
Source: n/a

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description: