CVE-2023-28358: XSS
A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-28358?
CVE-2023-28358 is classified as a high severity vulnerability due to its potential for exploitation leading to account takeover.
How do I fix CVE-2023-28358?
To mitigate CVE-2023-28358, ensure that the content security policy is enabled on the server.
What software versions are affected by CVE-2023-28358?
CVE-2023-28358 affects all versions of Rocket.Chat prior to 6.0.0.
What type of attacks can CVE-2023-28358 enable?
CVE-2023-28358 can enable attacks such as account takeover through the exploitation of the markdown parsing issue.
Can CVE-2023-28358 be exploited without a content security policy?
Yes, CVE-2023-28358 can be exploited on servers where the content security policy is disabled.