CVE-2017-18880: XSS
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the titlelink field of a Slack attachment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-18880?
CVE-2017-18880 is classified as a medium severity vulnerability due to its potential for exploitation through cross-site scripting (XSS).
How do I fix CVE-2017-18880?
To fix CVE-2017-18880, upgrade Mattermost Server to version 4.3.0 or later, or to 4.2.1 or later if you are using version 4.2.x.
Which versions of Mattermost Server are affected by CVE-2017-18880?
CVE-2017-18880 affects Mattermost Server versions prior to 4.3.0, and specifically versions 4.1.2, 4.2.0 up to 4.2.1, and all 4.3.0 release candidates.
What type of vulnerability is CVE-2017-18880?
CVE-2017-18880 is a cross-site scripting (XSS) vulnerability that can be exploited via the title_link field of a Slack attachment.
Is there a workaround for CVE-2017-18880?
There is no official workaround for CVE-2017-18880; it is recommended to update to a fixed version to mitigate the issue.