GHSA-63f2-6959-2pxj

Mattermost vulnerable to cross-site scripting (XSS)

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-1776

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/mattermost/mattermost-server/v6	>= 6.0.0, < 7.1.6	7.1.6
Go	github.com/mattermost/mattermost-server	>= 7.7.0, < 7.7.2	7.7.2
Go	github.com/mattermost/mattermost-server	>= 7.1.0, < 7.1.6	7.1.6
Go	github.com/mattermost/mattermost-server	>= 7.8.0, < 7.8.1	7.8.1
Go	github.com/mattermost/mattermost-server/v5	>= 5.0.0, < 7.1.6	7.1.6
Go	github.com/mattermost/mattermost-server/v6	>= 3.3.0, < 7.1.6	7.1.6

Details

As written in the advisory (Markdown source, shown as plain text).

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file. [Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00139

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-1776 advisory
https://github.com/mattermost/mattermost-server package
https://mattermost.com/security-updates web