« Volver al listado

CVE-2024-46934

Estado: ModificadaMedia (6.1)—

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rocket.chat — Rocket.chat

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-46934",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-46934",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-24T19:10:02.000214Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-09-25T01:15:44.597",
  "references": [
    {
      "url": "https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/RocketChat/Rocket.Chat/pull/33246",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload."
    },
    {
      "lang": "es",
      "value": "Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8 y versiones anteriores son vulnerables a ataques de Cross Site Scripting (XSS) basados en DOM. Los atacantes podrían abusar del método UpdateOTRAck para falsificar un mensaje que contenga un payload XSS."
    }
  ],
  "lastModified": "2026-06-17T07:56:13.057",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9B9DDD7-5E79-488F-BD2F-9B7EEBF7EC46",
              "versionEndExcluding": "6.7.9"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "842262D3-74EF-490E-B0DC-4DC0A0B185AA",
              "versionEndExcluding": "6.8.7",
              "versionStartIncluding": "6.8.0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "702723D8-57FB-402E-A6B7-39907F865998",
              "versionEndExcluding": "6.9.7",
              "versionStartIncluding": "6.9.0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C84DFE29-F5DE-411B-82B7-24DDBCD82CFF",
              "versionEndExcluding": "6.10.6",
              "versionStartIncluding": "6.10.0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5668FE7A-694F-4E18-960C-D2BFEC6890DF",
              "versionEndExcluding": "6.11.3",
              "versionStartIncluding": "6.11.0"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E57EDBB1-FF16-4A24-AED2-90D61FB47CE4"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "48C71A14-5A84-4CBD-BA42-07DE1EB5A320"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "403EB714-366A-4783-8547-00E4A3F4BF40"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "526F1CDD-BCD2-457E-A165-13ABE499F1EC"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DA3467D-B02C-4FA0-BE26-071FB1560183"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EAE65E7F-2D5B-4B26-A089-F0E4B5C72E24"
            },
            {
              "criteria": "cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E74704CE-0BCF-440D-9087-5B5D66DD0B01"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}