Description
Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mattermost | Mattermost | unspecified – ≤ 5.38 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/mattermost/mattermost-server | all versions | — | GO-2022-0604 |
| Go | github.com/mattermost/mattermost-server/v5 | < 5.39.0 | 5.39.0 | GHSA-hv5f-73mr-7vvj |