CVE-2023-1776: Stored XSS via SVG attachment on Boards
First published: Fri Mar 31 2023(Updated: )
Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.
Credit: responsibledisclosure@mattermost.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mattermost Mattermost Server | <7.1.6 | |
| Mattermost Mattermost Server | =7.7.1 |
Remedy
Update Mattermost to version v7.8.0, v7.1.6, v7.7.2, or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-1776.
What is the title of this vulnerability?
The title of this vulnerability is 'Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.'
What is the affected software?
The affected software is Mattermost Server version up to and including 7.1.6, and version 7.7.1.
What is the severity of this vulnerability?
The severity of this vulnerability is high.
How can I fix this vulnerability?
To fix this vulnerability, upgrade to a version of Mattermost Server that is not affected by this vulnerability.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/remedy
- agent/references
- agent/title
- agent/severity
- agent/tags
- agent/description
- agent/event
- agent/first-publish-date
- vendor/mattermost
- canonical/mattermost mattermost server
- version/mattermost mattermost server/7.7.1