CVE-2024-45621
MEDIUMCVSS 5.4/10EPSS 0.30%
Last modified
CVE-2024-45621 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Rocket.Chat | Rocket.Chat | <= 6.3.4 |
References
- https://hackerone.com/reports/1967109Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2024-45621?
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
How severe is CVE-2024-45621?
CVE-2024-45621 has a CVSS score of 5.4/10 (MEDIUM severity). The EPSS model estimates a 0.30% probability of exploitation in the next 30 days.
How do I fix CVE-2024-45621?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-45616A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
- CVE-2024-45617A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…3.9
- CVE-2024-45618A vulnerability was found in pkcs15-init in OpenSC. An attac…3.9
- CVE-2024-45619A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 m…4.3
- CVE-2024-4562 In WhatsUp Gold versions released before 2023.1.2 , an SS…5.4
- CVE-2024-45620A vulnerability was found in the pkcs15-init tool in OpenSC.…3.9
- CVE-2024-45622ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0…9.8
- CVE-2024-45623D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote …9.8
- CVE-2024-45624Exposure of sensitive information due to incompatible polici…7.5
- CVE-2024-45625Cross-site scripting vulnerability exists in Forminator vers…6.1
- CVE-2024-45626Apache James server JMAP HTML to text plain implementation i…7.5
- CVE-2024-45627In Apache Linkis <1.7.0, due to the lack of effective filter…5.9
Are you affected by CVE-2024-45621?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST