CVE-2022-1002CWE-80

HTML Injection while inviting Guests

Low · published March 18, 2022

CVSS v3.1
2.0
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00650 · 50.5th percentile
Weakness
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2022-03-18T18:00Z
EPSS history
Timeline
  • 18 MAR 18:00Z
    HTML Injection while inviting Guests
    cvelistv5