Rocket.Chat 6.12.0 Release Candidate 3

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:rocket.chat:rocket.chat:6.12.0:rc3:*:*:*:*:*:*

part: a version: 6.12.0 update: rc3

VendorRocket.Chat (617b1e93-7861-5e45-ab59-92186372afa4)
ProductRocket.Chat (e5bf3e71-5ab4-55f1-a289-af2224ae2fe5)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/rocketchat/rocket.chat purl2cpe 2026-06-01 10:18:04.479953

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-47048 vulnerable 2026-06-08 06:48:11.193284 Details available
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.
Published: 2024-09-24T00:00:00.000Z
Updated: 2025-03-25T16:10:41.543Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46935 vulnerable 2026-06-08 06:48:10.883147 Details available
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.
Published: 2024-09-24T00:00:00.000Z
Updated: 2025-03-25T16:20:43.536Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-46934 vulnerable 2026-06-08 06:48:10.880436 Details available
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.
Published: 2024-09-24T00:00:00.000Z
Updated: 2025-03-25T16:40:47.023Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.