CVE-2021-37860

2021-09-2217:15:11

Google

osv.dev

mattermost

clipboard

injection

web script

csp

AI Score

6.7

Confidence

High

EPSS

0.001

Percentile

25.9%

JSON

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.

References

mattermost.com/security-updates/