CVE-2020-8288 - Vulnerability Details - OpenCVE

ReportizFlow

The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:M/Au:S/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Rocket.chat	Rocket.chat

Configuration 1 [-]

cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://docs.rocket.chat/guides/security/security-updates
https://hackerone.com/reports/899954
https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/

History

No history.

MITRE

Status: PUBLISHED

Assigner: hackerone

Published: 2021-01-21T19:13:16.000Z

Updated: 2024-08-04T09:56:28.391Z

Reserved: 2020-01-28T00:00:00.000Z

Link: CVE-2020-8288

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-01-26T18:16:08.367

Modified: 2026-06-17T03:26:13.730

Link: CVE-2020-8288

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Rocket.Chat server", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in 3.9.2"}]}], "descriptions": [{"lang": "en", "value": "The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (XSS) - Stored (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-01-21T19:13:16.000Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/899954"}, {"tags": ["x_refsource_MISC"], "url": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/"}, {"tags": ["x_refsource_MISC"], "url": "https://docs.rocket.chat/guides/security/security-updates"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-8288", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Rocket.Chat server", "version": {"version_data": [{"version_value": "Fixed in 3.9.2"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-site Scripting (XSS) - Stored (CWE-79)"}]}]}, "references": {"reference_data": [{"name": "https://hackerone.com/reports/899954", "refsource": "MISC", "url": "https://hackerone.com/reports/899954"}, {"name": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/", "refsource": "MISC", "url": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/"}, {"name": "https://docs.rocket.chat/guides/security/security-updates", "refsource": "MISC", "url": "https://docs.rocket.chat/guides/security/security-updates"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:56:28.391Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/899954"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://docs.rocket.chat/guides/security/security-updates"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8288", "datePublished": "2021-01-21T19:13:16.000Z", "dateReserved": "2020-01-28T00:00:00.000Z", "dateUpdated": "2024-08-04T09:56:28.391Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Rocket.Chat server", "vendor": "n/a", "versions": [{"status": "affected", "version": "Fixed in 3.9.2"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF9B315-0C33-469E-A96C-77B613CA07BD", "versionEndExcluding": "3.9.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The `specializedRendering` function in Rocket.Chat server before 3.9.2 allows a cross-site scripting (XSS) vulnerability by way of the `value` parameter."}, {"lang": "es", "value": "La funci\u00f3n \"SpecialtyRendering\" en el servidor Rocket.Chat versiones anteriores a 3.9.2, permite una vulnerabilidad de tipo cross-site scripting (XSS) mediante el par\u00e1metro \"value\""}], "id": "CVE-2020-8288", "lastModified": "2026-06-17T03:26:13.730", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "[email protected]", "type": "Primary"}]}, "published": "2021-01-26T18:16:08.367", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://docs.rocket.chat/guides/security/security-updates"}, {"source": "[email protected]", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/899954"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://docs.rocket.chat/guides/security/security-updates"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://hackerone.com/reports/899954"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://rocket.chat/xss-vulnerability-hotfix-available-for-all-affected-versions/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}