A reflected XSS issue exists in the registration form in Rocket.Chat prior to 0.66. When one creates an account, the next step will ask for a username. This field will not save HTML control characters but an error will be displayed that shows the attempted username unescaped via packages/rocketchat-ui-login/client/username/username.js in packages/rocketchat-ui-login/client/username/username.html.
Vulnerable Product | Search on Vulmon | Subscribe to Product |
---|---|---|
rocket.chat rocket.chat |