CVE-2023-35075: HTML injection via channel autocomplete
Published Nov 27, 2023
·Updated
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.
Affected Software
4 affected componentsFixes available
go/github.com/mattermost/mattermost-server/v6<7.8.13
7.8.13
go/github.com/mattermost/mattermost/server/v8<8.1.4
8.1.4
Mattermost Mattermost<=7.8.12
Mattermost Mattermost>=8.0.0<=8.1.3
Remediation
Information
Update Mattermost Server to versions 7.8.13, 8.1.4 or higher.
Event History
Nov 27, 2023
CVE Published
via MITRE·09:09 AM
Data Sourced
via MITRE·09:09 AM
RemedyDescriptionSeverityWeakness
Advisory Published
12:30 PM
Frequently Asked Questions
1
What is the vulnerability ID of this mattermost vulnerability?
The vulnerability ID of this mattermost vulnerability is CVE-2023-35075.
2
What is the severity level of CVE-2023-35075?
The severity level of CVE-2023-35075 is low with a severity value of 3.1.
3
What is the affected software for CVE-2023-35075?
The affected software for CVE-2023-35075 is Mattermost, specifically versions up to and including 7.8.13 and versions up to and including 8.1.4.
4
How can an attacker exploit CVE-2023-35075?
An attacker can exploit CVE-2023-35075 by creating a channel name that is valid HTML, allowing them to inject HTML into a victim's page during autocomplete.
5
Is XSS possible as a result of CVE-2023-35075?
No, XSS is not possible as a result of CVE-2023-35075.