CVE-2018-13878: XSS
First published: Wed Jul 11 2018(Updated: )
An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rocket.Chat Rocket.Chat | <0.65 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2018-13878?
CVE-2018-13878 is classified as a medium severity vulnerability due to the potential exfiltration of sensitive user tokens.
How do I fix CVE-2018-13878?
To fix CVE-2018-13878, upgrade your Rocket.Chat installation to version 0.65 or later.
What does CVE-2018-13878 affect?
CVE-2018-13878 affects Rocket.Chat versions prior to 0.65 and specifically targets the Mentions feature in chat.
What type of vulnerability is CVE-2018-13878?
CVE-2018-13878 is an XSS vulnerability that arises from improper escaping of usernames in chat channels.
Can CVE-2018-13878 lead to user data exposure?
Yes, CVE-2018-13878 can potentially lead to exposure of secret tokens and other confidential user data.
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/softwarecombine
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/rocket.chat
- canonical/rocket.chat rocket.chat