CVE-2023-1776

MEDIUM5.4EPSS 0.71%

Mattermost vulnerable to cross-site scripting (XSS)

Published: 3/31/2023Modified: 12/6/2023

Also known as:GHSA-63f2-6959-2pxjBIT-mattermost-2023-1776

Description

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00139

Affected packages (4)

Bitnami/mattermostfrom 0, < 7.1.6 | >= 7.7.1, <= 7.7.1
Go/github.com/mattermost/mattermost-server>= 7.7.0, < 7.7.2
Go/github.com/mattermost/mattermost-server/v5>= 5.0.0, < 7.1.6
Go/github.com/mattermost/mattermost-server/v6>= 6.0.0, < 7.1.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-1776
PATCHhttps://github.com/mattermost/mattermost-server
WEBhttps://mattermost.com/security-updates
WEBhttps://mattermost.com/security-updates/