What is CVE-2022-35251?

CVE-2022-35251 is a medium-severity vulnerability in Rocket.chat, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-09-23.

How severe is CVE-2022-35251?

Medium severity. CVSS v3 base score is 5.4 out of 10.

XSS in Rocket.chat

CVE-2022-35251

A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets viewed.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.006 (44.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.

Affected products

Rocket.chat
N/a Rocket.chat — versions Fixed in 5.0>

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

support@hackerone.com (Exploit, Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2022-35251?: CVE-2022-35251 is a medium-severity vulnerability in Rocket.chat, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2022-09-23.
How severe is CVE-2022-35251?: Medium severity. CVSS v3 base score is 5.4 out of 10.