Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1oZjU1LWM0NDUtMnc5N8037w

Cross-site Scripting in @rocket.chat/livechat

A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.

Permalink: https://github.com/advisories/GHSA-hf55-c445-2w97
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1oZjU1LWM0NDUtMnc5N8037w
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago


CVSS Score: 6.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Identifiers: GHSA-hf55-c445-2w97, CVE-2022-21830
References: Repository: https://github.com/RocketChat/Rocket.Chat.Livechat
Blast Radius: 15.0

Affected Packages

npm:@rocket.chat/livechat
Dependent packages: 2
Dependent repositories: 293
Downloads: 179 last month
Affected Version Ranges: < 1.9.0
Fixed in: 1.9.0
All affected versions: 1.1.3, 1.1.4, 1.1.6, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, 1.3.0, 1.3.1, 1.4.0, 1.5.0, 1.6.0, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.7.6, 1.8.0
All unaffected versions: 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5, 1.9.6, 1.10.0, 1.11.0, 1.11.1, 1.11.2, 1.12.0, 1.12.1, 1.12.2, 1.13.0, 1.13.1, 1.13.2, 1.13.3