CVE-2024-46934

Published: Sep 25, 2024Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

Affected (12)

Products: Rocket.chat: Rocket.chat

Rocket.chat

1 product

Rocket.chat

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Rocket.chat Rocket.chat	version < 6.7.9
Rocket.chat Rocket.chat	6.10.0 ≤ version < 6.10.6
Rocket.chat Rocket.chat	6.11.0 ≤ version < 6.11.3
Rocket.chat Rocket.chat	6.8.0 ≤ version < 6.8.7
Rocket.chat Rocket.chat	6.9.0 ≤ version < 6.9.7
Rocket.chat Rocket.chat	Version 6.12.0
Rocket.chat Rocket.chat	Version 6.12.0 rc1
Rocket.chat Rocket.chat	Version 6.12.0 rc2
Rocket.chat Rocket.chat	Version 6.12.0 rc3
Rocket.chat Rocket.chat	Version 6.12.0 rc4
Rocket.chat Rocket.chat	Version 6.12.0 rc5
Rocket.chat Rocket.chat	Version 6.12.0 rc6

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories

Source: cve@mitre.org

Release Notes

https://github.com/RocketChat/Rocket.Chat/pull/33246

Source: cve@mitre.org

Patch

Timeline

No history available yet.