What is GHSA-jc6w-8r7f-vmp5?

GHSA-jc6w-8r7f-vmp5 is a security advisory published by GitHub Security Advisories with High severity. Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Which CVE IDs does GHSA-jc6w-8r7f-vmp5 cover?

GHSA-jc6w-8r7f-vmp5 covers the following CVE IDs: CVE-2017-18871. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jc6w-8r7f-vmp5?

GHSA-jc6w-8r7f-vmp5 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jc6w-8r7f-vmp5?

GHSA-jc6w-8r7f-vmp5 affects 4 products, including: go/github.com/mattermost/mattermost-server:\u003c 4.2.2; go/github.com/mattermost/mattermost-server:\u003e= 4.3.0-rc1, \u003c 4.3.4; go/github.com/mattermost/mattermost-server:\u003e= 4.4.0-rc1, \u003c 4.4.5; go/github.com/mattermost/mattermost-server:\u003e= 4.5.0-rc1, \u003c 4.5.0.

GHSA-jc6w-8r7f-vmp5HighCVSS 7.5

Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 3, 2025

🔗 CVE IDs covered (1)

CVE-2017-18871 →

📋 Description

An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service (application crash) via an @ character before a JavaScript field name.

🎯 Affected products4

go/github.com/mattermost/mattermost-server:< 4.2.2
go/github.com/mattermost/mattermost-server:>= 4.3.0-rc1, < 4.3.4
go/github.com/mattermost/mattermost-server:>= 4.4.0-rc1, < 4.4.5
go/github.com/mattermost/mattermost-server:>= 4.5.0-rc1, < 4.5.0

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2017-18871
https://mattermost.com/security-updates
https://github.com/advisories/GHSA-jc6w-8r7f-vmp5