CVE-2016-11084

Description

Mattermost Server allows XSS via CSRF in github.com/mattermost/mattermost-server

How to fix CVE-2016-11084

To remediate CVE-2016-11084, upgrade the affected package to a fixed version below.

• Go/github.com/mattermost/mattermost-server—upgrade to 2.1.0 or later
• Go/github.com/mattermost/mattermost-server—upgrade to 2.1.0+incompatible or later

Is CVE-2016-11084 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 2.1.0
• from 0, < 2.1.0+incompatible

CVSS scores

References (4)

• ADVISORYgithub.com/advisories/GHSA-vw57-55f8-c73q
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2016-11084
• PATCHgithub.com/mattermost/mattermost
• WEBmattermost.com/security-updates