VULNERABILITY INTELLIGENCE

CVE-2023-28358

CVSS score6.1 MEDIUM

EPSS probability0.39%

CISA KEVNot currently listed

Published2023-05-11

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

A vulnerability has been discovered in Rocket.Chat where a markdown parsing issue in the "Search Messages" feature allows the insertion of malicious tags. This can be exploited on servers with content security policy disabled possible leading to some issues attacks like account takeover.

Weakness classification

support@hackerone.com: CWE-79
nvd@nist.gov: CWE-79
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

support@hackerone.com — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory