CVE-2017-18900 Mattermost Server is vulnerable CSV Injection
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | < 3.10.3 | 3.10.3 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 4.0.0, < 4.0.3 | 4.0.3 |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | < 3.10.3+incompatible | 3.10.3+incompatible |
| Mattermost github.com/mattermost/mattermost-server/v6(Go) | >= 4.0.0+incompatible, < 4.0.3+incompatible | 4.0.3+incompatible |
| mattermost server | < 3.10.3 | 3.10.3 |
| mattermost server | >= 4.0.0, < 4.0.4 | 4.0.4 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com product
- mattermost.com vendor-advisory
- github.com vendor-advisory