~ / search / GHSA-h3gq-j7p9-x3p4

GHSA-h3gq-j7p9-x3p4

Mattermost Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2023-7113

Packages

EcosystemPackageAffectedFixed in
Go github.com/mattermost/mattermost/server/v8 < 8.1.7 8.1.7

Details

As written in the advisory (Markdown source, shown as plain text).

Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.

References

External links from the advisory. They lead to third-party sites.