Skip to content
OpenAdvisories
Low · 3.7 CVE-2023-7113 BIT-mattermost-2023-7113EUVD-2023-3217GHSA-h3gq-j7p9-x3p4GO-2024-2446

Mattermost Cross-site Scripting vulnerability

Published Dec 29, 2023 · Updated Aug 2, 2024 · Assigned by Mattermost

Vendor: Mattermost Product: Mattermost Package: github.com/mattermost/mattermost-server Package: github.com/mattermost/mattermost-server/v5 Package: github.com/mattermost/mattermost-server/v6 Package: github.com/mattermost/mattermost/server/v8 Ecosystem: Go

Description

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Affected products

VendorProductAffectedFixed
Mattermost Mattermost ≤ 8.1.6, ≤ 9.2.0 8.1.7

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/mattermost/mattermost-server all versions — GO-2024-2446
Go github.com/mattermost/mattermost-server/v5 all versions — GO-2024-2446
Go github.com/mattermost/mattermost-server/v6 all versions — GO-2024-2446
Go github.com/mattermost/mattermost/server/v8 < 8.1.7 8.1.7 GHSA-h3gq-j7p9-x3p4
Go github.com/mattermost/mattermost/server/v8 all versions — GO-2024-2446

References