GHSA-rm24-25xm-9454

Source

https://github.com/advisories/GHSA-rm24-25xm-9454

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rm24-25xm-9454/GHSA-rm24-25xm-9454.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rm24-25xm-9454

Aliases

Published

2022-05-24T17:21:02Z

Modified

2025-11-05T19:57:13.832578Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Mattermost Server: Files may be rendered inline instead of downloaded, allowing script execution

Details

An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2020-06-19T20:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed_at": "2025-10-22T21:58:04Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/mattermost/mattermost-server

Package

Name: github.com/mattermost/mattermost-server; View open source insights on deps.dev
Purl: pkg:golang/github.com/mattermost/mattermost-server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rm24-25xm-9454/GHSA-rm24-25xm-9454.json"