CVE-2023-1776

Summary

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

Affected Software

VendorProductVersion RangeStatus
MattermostMattermost3.3.0 <= 7.7.1affected
MattermostMattermost3.3.0 <= 7.1.5affected
MattermostMattermost3.3.0 < 7.8.0affected
MattermostMattermost7.8.0unaffected
MattermostMattermost7.7.2unaffected
MattermostMattermost7.1.6unaffected

Weaknesses

  • CWE-79: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References