CVE-2021-37859

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost...

CVE-2021-37859

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost...

CVE-2021-37859 Reflected XSS in OAuth Flow

Fixed a bypass for a reflected cross-site scripting vulnerability affecting OAuth-enabled instances of Mattermost...

CVE-2021-37859

Mattermost Server (OAuth flow) is affected by CVE-2021-37859. A reflected XSS vulnerability arises because the redirect_to parameter in the OAuth login path is not sanitized when rendering the mobile error page, which can reflect user-controlled input into HTML. Exploitation via crafted redirect_...