| Package | Affected versions | Patched versions |
|---|---|---|
| rocket.chat | = 6.12.0≥ 6.10.0, < 6.10.6≥ 6.11.0, < 6.11.3≥ 6.8.0, < 6.8.7≥ 6.9.0, < 6.9.7< 6.7.9 | 6.10.66.11.36.8.76.9.76.7.9 |
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free