VulnerabilityModified
CVE-2017-18914
An external link can occur on an error page even if it is not on an allowlist.
MEDIUM 5.3EPSS 0.81%
Does this matter?
Lower severity and a low EPSS score (0.81%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.81% probability · 55th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-754
- Affected
- mattermost/mattermost server
- Source
- cve@mitre.org
References
- https://mattermost.com/security-updates/Vendor Advisory
- https://mattermost.com/security-updates/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.