CVE:CVE-2017-1000054
CNNVD:CNNVD-201707-807
Rocket.Chat是一个开源的搭建在JavaScript中的使用Meteor fullstack框架开发的Web聊天服务器。
Rocket.Chat 0.8版本至0.57.2版本中的用于消息的markdown链接解析代码存在跨站脚本漏洞。远程攻击者可利用该漏洞注入任意的Web脚本或HTML。
solution:Upgrade rocketchat rocket.chat to a higher version than 0.8.0,0.9.0,0.10.0,0.10.1,0.10.2,0.11.0,0.12.0,0.12.1,0.13.0,0.14.0,0.15.0,0.16.0,0.17.0,0.18.0,0.18.1,0.19.0,0.20.0,0.21.0,0.22.0,0.23.0,0.24.0,0.25.0,0.26.0,0.27.0,0.28.0,0.29.0,0.30.0,0.31.0,0.32.0,0.33.0,0.34.0,0.35.0,0.36.0,0.37.0,0.37.1,0.38.0,0.39.0,0.40.1,0.41.0,0.42.0,0.43.0,0.44.0,0.45.0,0.46.0,0.47.0,0.47.1,0.48.0,0.48.1,0.48.2,0.49.0,0.49.1,0.49.2,0.49.3,0.49.4,0.50.0,0.50.1,0.51.0,0.52.0,0.53.0,0.54.0,0.54.1,0.54.2,0.55.0,0.55.1,0.56.0,0.57.0,0.57.0:rc0,0.57.0:rc1,0.57.0:rc2,0.57.0:rc3,0.57.1,0.57.2,and avoid the version 0.8.0,0.9.0,0.10.0,0.10.1,0.10.2,0.11.0,0.12.0,0.12.1,0.13.0,0.14.0,0.15.0,0.16.0,0.17.0,0.18.0,0.18.1,0.19.0,0.20.0,0.21.0,0.22.0,0.23.0,0.24.0,0.25.0,0.26.0,0.27.0,0.28.0,0.29.0,0.30.0,0.31.0,0.32.0,0.33.0,0.34.0,0.35.0,0.36.0,0.37.0,0.37.1,0.38.0,0.39.0,0.40.1,0.41.0,0.42.0,0.43.0,0.44.0,0.45.0,0.46.0,0.47.0,0.47.1,0.48.0,0.48.1,0.48.2,0.49.0,0.49.1,0.49.2,0.49.3,0.49.4,0.50.0,0.50.1,0.51.0,0.52.0,0.53.0,0.54.0,0.54.1,0.54.2,0.55.0,0.55.1,0.56.0,0.57.0,0.57.0:rc0,0.57.0:rc1,0.57.0:rc2,0.57.0:rc3,0.57.1,0.57.2