CVE-2017-1000054

nvd nist

Published: Jul 17, 2017Modified: May 13, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.

Affected (72)

Products: Rocketchat: Rocket.chat

Rocketchat

1 product

Rocket.chat

Configuration A

72 vulnerable

Vulnerable Software	Affected Versions
Rocketchat Rocket.chat	Version 0.10.0
Rocketchat Rocket.chat	Version 0.10.1
Rocketchat Rocket.chat	Version 0.10.2
Rocketchat Rocket.chat	Version 0.11.0
Rocketchat Rocket.chat	Version 0.12.0
Rocketchat Rocket.chat	Version 0.12.1
Rocketchat Rocket.chat	Version 0.13.0
Rocketchat Rocket.chat	Version 0.14.0
Rocketchat Rocket.chat	Version 0.15.0
Rocketchat Rocket.chat	Version 0.16.0
Rocketchat Rocket.chat	Version 0.17.0
Rocketchat Rocket.chat	Version 0.18.0
Rocketchat Rocket.chat	Version 0.18.1
Rocketchat Rocket.chat	Version 0.19.0
Rocketchat Rocket.chat	Version 0.20.0
Rocketchat Rocket.chat	Version 0.21.0
Rocketchat Rocket.chat	Version 0.22.0
Rocketchat Rocket.chat	Version 0.23.0
Rocketchat Rocket.chat	Version 0.24.0
Rocketchat Rocket.chat	Version 0.25.0
Rocketchat Rocket.chat	Version 0.26.0
Rocketchat Rocket.chat	Version 0.27.0
Rocketchat Rocket.chat	Version 0.28.0
Rocketchat Rocket.chat	Version 0.29.0
Rocketchat Rocket.chat	Version 0.30.0
Rocketchat Rocket.chat	Version 0.31.0
Rocketchat Rocket.chat	Version 0.32.0
Rocketchat Rocket.chat	Version 0.33.0
Rocketchat Rocket.chat	Version 0.34.0
Rocketchat Rocket.chat	Version 0.35.0
Rocketchat Rocket.chat	Version 0.36.0
Rocketchat Rocket.chat	Version 0.37.0
Rocketchat Rocket.chat	Version 0.37.1
Rocketchat Rocket.chat	Version 0.38.0
Rocketchat Rocket.chat	Version 0.39.0
Rocketchat Rocket.chat	Version 0.40.1
Rocketchat Rocket.chat	Version 0.41.0
Rocketchat Rocket.chat	Version 0.42.0
Rocketchat Rocket.chat	Version 0.43.0
Rocketchat Rocket.chat	Version 0.44.0
Rocketchat Rocket.chat	Version 0.45.0
Rocketchat Rocket.chat	Version 0.46.0
Rocketchat Rocket.chat	Version 0.47.0
Rocketchat Rocket.chat	Version 0.47.1
Rocketchat Rocket.chat	Version 0.48.0
Rocketchat Rocket.chat	Version 0.48.1
Rocketchat Rocket.chat	Version 0.48.2
Rocketchat Rocket.chat	Version 0.49.0
Rocketchat Rocket.chat	Version 0.49.1
Rocketchat Rocket.chat	Version 0.49.2
Rocketchat Rocket.chat	Version 0.49.3
Rocketchat Rocket.chat	Version 0.49.4
Rocketchat Rocket.chat	Version 0.50.0
Rocketchat Rocket.chat	Version 0.50.1
Rocketchat Rocket.chat	Version 0.51.0
Rocketchat Rocket.chat	Version 0.52.0
Rocketchat Rocket.chat	Version 0.53.0
Rocketchat Rocket.chat	Version 0.54.0
Rocketchat Rocket.chat	Version 0.54.1
Rocketchat Rocket.chat	Version 0.54.2
Rocketchat Rocket.chat	Version 0.55.0
Rocketchat Rocket.chat	Version 0.55.1
Rocketchat Rocket.chat	Version 0.56.0
Rocketchat Rocket.chat	Version 0.57.0
Rocketchat Rocket.chat	Version 0.57.0 rc0
Rocketchat Rocket.chat	Version 0.57.0 rc1
Rocketchat Rocket.chat	Version 0.57.0 rc2
Rocketchat Rocket.chat	Version 0.57.0 rc3
Rocketchat Rocket.chat	Version 0.57.1
Rocketchat Rocket.chat	Version 0.57.2
Rocketchat Rocket.chat	Version 0.8.0
Rocketchat Rocket.chat	Version 0.9.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://www.theblazehen.com/posts/CVE-2017-xxxxxx-rocketchat-xss-with-markdown-url-handling-in-messages/

Source: cve@mitre.org

Broken LinkURL Repurposed

https://www.theblazehen.com/posts/CVE-2017-xxxxxx-rocketchat-xss-with-markdown-url-handling-in-messages/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkURL Repurposed

Timeline

No history available yet.