What is GHSA-63f2-6959-2pxj?

GHSA-63f2-6959-2pxj is a security advisory published by GitHub Security Advisories with Medium severity. Mattermost vulnerable to cross-site scripting (XSS)

Which CVE IDs does GHSA-63f2-6959-2pxj cover?

GHSA-63f2-6959-2pxj covers the following CVE IDs: CVE-2023-1776. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-63f2-6959-2pxj?

GHSA-63f2-6959-2pxj has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-63f2-6959-2pxj?

GHSA-63f2-6959-2pxj affects 6 products, including: go/github.com/mattermost/mattermost-server/v6:\u003e= 6.0.0, \u003c= 6.7.2; go/github.com/mattermost/mattermost-server:\u003e= 7.7.0, \u003c= 7.7.1; go/github.com/mattermost/mattermost-server:\u003e= 7.1.0, \u003c= 7.1.5; go/github.com/mattermost/mattermost-server:= 7.8.0; go/github.com/mattermost/mattermost-server/v5:\u003e= 5.0.0, \u003c= 5.39.3; and others — see the full list on the advisory page.

GHSA-63f2-6959-2pxjMediumCVSS 5.4

Mattermost vulnerable to cross-site scripting (XSS)

Vendor

GitHub Security Advisories

Published

March 31, 2023

Last Modified

April 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-1776 →

📋 Description

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

Issue Identifier: MMSA-2023-00139

🎯 Affected products6

go/github.com/mattermost/mattermost-server/v6:>= 6.0.0, <= 6.7.2
go/github.com/mattermost/mattermost-server:>= 7.7.0, <= 7.7.1
go/github.com/mattermost/mattermost-server:>= 7.1.0, <= 7.1.5
go/github.com/mattermost/mattermost-server:= 7.8.0
go/github.com/mattermost/mattermost-server/v5:>= 5.0.0, <= 5.39.3
go/github.com/mattermost/mattermost-server/v6:>= 3.3.0, <= 4.10.10

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-1776
https://mattermost.com/security-updates/
https://github.com/advisories/GHSA-63f2-6959-2pxj