| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/mattermost/mattermost-server | ≥ 10.0.0+incompatible, < 10.0.4+incompatible≥ 10.1.0+incompatible, < 10.1.4+incompatible≥ 10.2.0+incompatible, < 10.2.1+incompatible≥ 9.11.0+incompatible, < 9.11.6+incompatible | 10.0.4+incompatible10.1.4+incompatible10.2.1+incompatible9.11.6+incompatible |
| github.com/mattermost/mattermost-server/v5 | all versions | |
| github.com/mattermost/mattermost-server/v6 | all versions | |
| github.com/mattermost/mattermost/server/v8 | ≥ 10.0.0, < 10.0.4≥ 10.1.0, < 10.1.4≥ 10.2.0, < 10.2.1≥ 9.11.0, < 9.11.6< 8.0.0-20241127161322-25ff7a3779a5 | 10.0.410.1.410.2.19.11.68.0.0-20241127161322-25ff7a3779a5 |
| mattermost server | = 10.2.0≥ 10.0.0, < 10.0.4≥ 10.1.0, < 10.1.4≥ 9.11.0, < 9.11.6 | 10.0.410.1.49.11.6 |
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free