CVE-2018-13878

MEDIUM

Rocket.Chat < 0.65 - Stored Cross-Site Scripting via User Mention Real Name

Title source: llm

Description

An XSS issue was discovered in packages/rocketchat-mentions/Mentions.js in Rocket.Chat before 0.65. The real name of a username is displayed unescaped when the user is mentioned (using the @ symbol) in a channel or private chat. Consequently, it is possible to exfiltrate the secret token of every user and also admins in the channel.

References (1)

Core 1

Core References

Issue Tracking, Third Party Advisory x_refsource_confirm

https://github.com/RocketChat/Rocket.Chat/pull/10793

Scores

CVSS v3 6.1

EPSS 0.0076

EPSS Percentile 50.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

rocket.chat/rocket.chat < 0.65

Published Jul 11, 2018

Tracked Since Feb 18, 2026