TI-2024-31331 Aliases CVE-2024-46934 GHSA-c2c6-68mw-462f

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to…

LOW 27CWE-79Published 2024-09-24 · Updated 2025-03-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00334 26th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:rocket.chat:rocket.chat::::::::	before 6.7.9; 6.8.0 to before 6.8.7; 6.9.0 to before 6.9.7; 6.10.0 to before 6.10.6; 6.11.0 to before 6.11.3	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:-::::::	6.12.0	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc1::::::	6.12.0 rc1	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc2::::::	6.12.0 rc2	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc3::::::	6.12.0 rc3	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc4::::::	6.12.0 rc4	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc5::::::	6.12.0 rc5	Vulnerable	Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc6::::::	6.12.0 rc6	Vulnerable	Rocket.Chat

cpe:2.3:a:rocket.chat:rocket.chat:*:*:*:*:*:*:*:* Versions before 6.7.9; 6.8.0 to before 6.8.7; 6.9.0 to before 6.9.7; 6.10.0 to before 6.10.6; 6.11.0 to before 6.11.3 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:-:*:*:*:*:*:* Versions 6.12.0 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc1:*:*:*:*:*:* Versions 6.12.0 rc1 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc2:*:*:*:*:*:* Versions 6.12.0 rc2 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc3:*:*:*:*:*:* Versions 6.12.0 rc3 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc4:*:*:*:*:*:* Versions 6.12.0 rc4 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc5:*:*:*:*:*:* Versions 6.12.0 rc5 Vulnerable ·Rocket.Chat
cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc6:*:*:*:*:*:* Versions 6.12.0 rc6 Vulnerable ·Rocket.Chat

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-46934
2026-10-03 Alias added: GHSA-c2c6-68mw-462f

References

Patch 1

https://github.com/RocketChat/Rocket.Chat/pull/33246

Other 1

https://docs.rocket.chat/docs/rocketchat-security-fixes-updates-and-advisories

TI-2021-05772 A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 &… CVSS 3.1CRITICAL 9.8
TI-2022-13921 SQL injection in Rocket.Chat CVSS 3.1HIGH 8.8
TI-2026-18910 Rocket.Chat Unauthorized Access to OAuth App Details CVSS 3.1HIGH 7.7
TI-2022-12398 Improper authentication in Rocket.Chat Mobile app CVSS 3.1MEDIUM 6.8
TI-2022-13929 Information disclosure in Rocket.Chat CVSS 3.1MEDIUM 6.5
TI-2022-15931 Cross-site scripting in Rocket.chat CVSS 3.1MEDIUM 5.4

See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences