What is CVE-2023-28358?

CVE-2023-28358 is a medium-severity vulnerability in Rocket.chat, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-05-11.

How severe is CVE-2023-28358?

Medium severity. CVSS v3 base score is 6.1 out of 10.

XSS in Rocket.chat

CVE-2023-28358

A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.004 (32.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Rocket.chat
N/a Rocket.chat — versions This issue has been fixed in version 6.0> and is backported for the supported versions. Check this document for more info: https://docs.rocket.chat/resources/get-support/enterprise-support#rocket.chat-versions

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

support@hackerone.com (Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2023-28358?: CVE-2023-28358 is a medium-severity vulnerability in Rocket.chat, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2023-05-11.
How severe is CVE-2023-28358?: Medium severity. CVSS v3 base score is 6.1 out of 10.