Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.
{
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47048.json"
}{
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "6.7.9"
},
{
"introduced": "6.8.0"
},
{
"fixed": "6.8.7"
},
{
"introduced": "6.9.0"
},
{
"fixed": "6.9.7"
},
{
"introduced": "6.10.0"
},
{
"fixed": "6.10.6"
},
{
"introduced": "6.11.0"
},
{
"fixed": "6.11.3"
},
{
"introduced": "6.12.0-NA"
},
{
"last_affected": "6.12.0-NA"
}
],
"cpe": [
"cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*",
"cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:-:*:*:*:*:*:*"
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}