CVE-2017-18879

Mattermost Server is affected by an XSS vulnerability via the author_link field in Slack attachments. Exploitation targets versions before 4.3.0, 4.2.1, and 4.1.2. Root cause: improper handling of Slack attachment author_link content leading to script execution. Remediation: upgrade to Mattermost...

CVE-2017-18879: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...