CVE-2018-13879 | BDVDB-2026-104263 Detail

Description#

A reflected XSS issue was discovered in the registration form in Rocket.Chat before 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/RocketChat/Rocket.Chat/issues/10795

Exploit#

No public exploit known

History#

Version 12018-07-11Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.