medium5.4
CVE-2020-8288
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
Impact
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | before 3.9.2 |
Weakness classification
References
- NVD record
- CVE.org record
- https://docs.rocket.chat/guides/security/security-updates
- https://hackerone.com/reports/899954
- https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/
- https://docs.rocket.chat/guides/security/security-updates
- https://hackerone.com/reports/899954
- https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/