medium6.1
CVE-2017-18904
Mattermost Server vulnerable to XSS via an uploaded file
Impact
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/mattermost/mattermost-server | < 3.9.2 | 3.9.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mattermost | Mattermost Server | before 3.9.2 from 3.10.0 before 3.10.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://mattermost.com/security-updates/
- https://github.com/advisories/GHSA-8pff-p3gx-w4jf
- https://nvd.nist.gov/vuln/detail/CVE-2017-18904
- https://github.com/mattermost/mattermost/commit/6a2754376c8c8270be5e11e3fdab589659d0cc8d
- https://github.com/mattermost/mattermost/commit/bde06a7bc3a03a56da224c1ffcd8bffb0af8071b
- https://github.com/mattermost/mattermost/commit/f06c5bef4d78966c60b153bbec6eea4ec0be9e68
- https://mattermost.com/security-updates