Description (CNA)
The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / Rocket.Chat server | affected Fixed in 3.9.2 |
CWE
CWE-79
References
- https://hackerone.com/reports/899954
- https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/
- https://docs.rocket.chat/guides/security/security-updates
ADP enrichment
No English description supplied.