PT-2021-21892 · Mattermost · Mattermost

Published 2021-09-22 · Updated 2024-08-21 · CVE-2021-37860

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mattermost versions 5.38 and earlier

Description: The issue is related to insufficient sanitization of clipboard contents, allowing a user-assisted attacker to inject arbitrary web script in product deployments where the default Content Security Policy (CSP) is explicitly disabled. This enables the attacker to perform cross-site scripting attacks.

Recommendations: For Mattermost versions 5.38 and earlier, update to a version that includes the fix for this issue to prevent arbitrary web script injection. As a temporary workaround, consider enabling the default CSP to minimize the risk of exploitation. Restrict access to clipboard contents in deployments where the default CSP is disabled to reduce the attack surface.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-37860

GHSA-HV5F-73MR-7VVJ

GO-2022-0604

Affected Products

Mattermost

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2021-37860 · Security Note
• https://osv.dev/vulnerability/GHSA-hv5f-73mr-7vvj · Vendor Advisory
• https://mattermost.com/security-updates · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37860 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0604 · Vendor Advisory
• https://github.com/mattermost/mattermost-server · Note
• https://github.com/advisories/GHSA-hv5f-73mr-7vvj · Note
• https://t.me/cvenotify/21299 · Telegram Post
• https://t.me/cibsecurity/29239 · Telegram Post
• https://docs.mattermost.com/install/self-managed-changelog.html#release-v5-39-quality-release · Note