CVE-2021-37860

LOW

Mattermost < 5.38 - Stored Cross-Site Scripting via Clipboard Content

Title source: llm

Description

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://mattermost.com/security-updates/

Scores

CVSS v3 3.7

EPSS 0.0021

EPSS Percentile 43.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (2)

mattermost/mattermost < 5.38

mattermost/mattermost-server 0 - 5.39.0Go

Published Sep 22, 2021

Tracked Since Feb 18, 2026