CVE-2023-1776

2023-03-3112:15:06

CWE-79

[email protected]

web.nvd.nist.gov

cve-2023-1776

mattermost

svg

image file

attachment

security vulnerability

nvd

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.5%

JSON

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

Affected configurations

NVD

Node

mattermostmattermost_serverRange<7.1.6

mattermostmattermost_serverMatch7.7.1

CPENameOperatorVersion
mattermost:mattermost_servermattermost mattermost serverlt7.1.6
mattermost:mattermost_servermattermost mattermost servereq7.7.1

CPE	Name	Operator	Version
mattermost:mattermost_server	mattermost mattermost server	lt	7.1.6
mattermost:mattermost_server	mattermost mattermost server	eq	7.7.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Mattermost",
    "vendor": "Mattermost",
    "versions": [
      {
        "lessThanOrEqual": "7.7.1",
        "status": "affected",
        "version": "3.3.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "7.1.5",
        "status": "affected",
        "version": "3.3.0",
        "versionType": "semver"
      },
      {
        "lessThan": "7.8.0",
        "status": "affected",
        "version": "3.3.0",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "7.8.0"
      },
      {
        "status": "unaffected",
        "version": "7.7.2"
      },
      {
        "status": "unaffected",
        "version": "7.1.6"
      }
    ]
  }
]