CVE-2023-35075 — HTML injection via channel autocomplete

CVE-2023-35075

HTML injection via channel autocomplete PUBLISHED

Description (CNA)

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though.

Affected (CNA)

Vendor / product	Versions
Mattermost / Mattermost	affected 0 through 8.1.3; affected 0 through 7.8.12; unaffected 7.8.13; unaffected 8.1.4

CWE

CWE-74

References

https://mattermost.com/security-updates

ADP enrichment

CVE

No English description supplied.

https://mattermost.com/security-updates

CISA-ADP

No English description supplied.

No references supplied.