GitHub Advisoryadvisory · Go

GHSA-h3gq-j7p9-x3p4 Mattermost Cross-site Scripting vulnerability

LOW Published 2023-12-29 Modified 2024-07-08 Official page ↗
Aliases
CVE-2023-7113
Ecosystem
Go
Packages
github.com/mattermost/mattermost/server/v8
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-03

Affected packages

• Go github.com/mattermost/mattermost/server/v8: < 8.1.7 → fixed in 8.1.7

Description

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

Related

Alias · CVE (1)

  • CVE-2023-7113 Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References