GHSA-jcgv-3pfq-j4hr CVE-2023-35075
Mattermost Injection vulnerability
- Severity
- 3.1 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.37%
- Chance of exploitation in the next 30 days. Higher than 30.63% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
- Available
- 2 packages have a fixed version
Description
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/mattermost/mattermost-server/v6 | < 7.8.13 |
7.8.13 |
| github.com/mattermost/mattermost/server/v8 | < 8.1.4 |
8.1.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/mattermost/mattermost-server/v6 Go → 7.8.13
- go
go get github.com/mattermost/mattermost-server/v6@v7.8.13 && go mod tidy
github.com/mattermost/mattermost/server/v8 Go → 8.1.4
- go
go get github.com/mattermost/mattermost/server/v8@v8.1.4 && go mod tidy
Severity breakdown
CVSS 3.1 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xmfh-3ccg-c9fx Mattermost has an Incorrect Authorization issue | Low | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-6hxm-w4hv-vgvw Mattermost doesn't require role-management authorization when setting the scheme_admin flag on group syncable link and patch endpoints | High | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-9p44-r552-4wp9 Mattermost doesn't sanitize the Remote Cluster API response on PATCH operations | Medium | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-8qq9-cqj8-82w4 Mattermost doesn't sanitize FileInfo.Name received from federated peers during shared channel file sync | High | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-m2w9-h2mm-79qr Mattermost doesn't require system-level permission when patching protected default system roles | High | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-c28q-m4gf-vg4q Mattermost doesn't enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation | Medium | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-3vmp-whvv-5v9v Mattermost doesn't validate that a username returned during bot registration belongs to a bot account | Medium | Also affects github.com/mattermost/mattermost-server/v6 |
| GHSA-rp4v-qc77-phm4 Mattermost doesn't restrict role_updated websocket event broadcasts to members of the affected team or channel | Medium | Also affects github.com/mattermost/mattermost-server/v6 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor