CVE-2023-1776

MEDIUM5.4EPSS 0.71%

Mattermost vulnerable to cross-site scripting (XSS)

發布日:2023/3/31修改日:2023/12/6

也稱為:GHSA-63f2-6959-2pxjBIT-mattermost-2023-1776

描述

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00139

受影響套件(4)

Bitnami/mattermostfrom 0, < 7.1.6 | >= 7.7.1, <= 7.7.1
Go/github.com/mattermost/mattermost-server>= 7.7.0, < 7.7.2
Go/github.com/mattermost/mattermost-server/v5>= 5.0.0, < 7.1.6
Go/github.com/mattermost/mattermost-server/v6>= 6.0.0, < 7.1.6

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-1776
PATCHhttps://github.com/mattermost/mattermost-server
WEBhttps://mattermost.com/security-updates
WEBhttps://mattermost.com/security-updates/