CVE-2021-22886: rocket.chat

csirt@kutim:~/threat-intel/cve/CVE-2021-22886

CVSS 6.1 · Medium EPSS 1,7%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada rocket.chat. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Rocket.Chat before 3.11, 3.10.5, 3.9.7, 3.8.8 is vulnerable to persistent cross-site scripting (XSS) using nested markdown tags allowing a remote attacker to inject arbitrary JavaScript in a message. This flaw leads to arbitrary file read and RCE on Rocket.Chat desktop app.

Rincian

Terbit di NVD: 26 Maret 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,7% peluang dieksploitasi; lebih tinggi dari 76,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
rocket.chat	rocket.chat	Semua versi sebelum 3.8.8
rocket.chat	rocket.chat	Versi 3.9.0 hingga sebelum 3.9.7
rocket.chat	rocket.chat	Versi 3.10.0 hingga sebelum 3.10.5
rocket.chat	rocket.chat	Versi 3.11.0 rc0
rocket.chat	rocket.chat	Versi 3.11.0 rc1
rocket.chat	rocket.chat	Versi 3.11.0 rc2
rocket.chat	rocket.chat	Versi 3.11.0 rc3
rocket.chat	rocket.chat	Versi 3.11.0 rc4
rocket.chat	rocket.chat	Versi 3.11.0 rc5
rocket.chat	rocket.chat	Versi 3.11.0 rc6
rocket.chat	rocket.chat	Versi 3.11.0 rc7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://docs.rocket.chat/guides/security/security-updates advisory vendor
https://github.com/RocketChat/Rocket.Chat/pull/20430 patch · advisory pihak ketiga
https://hackerone.com/reports/1014459 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.