« Volver al listado

CVE-2017-18892

Estado: ModificadaMedia (6.1)—

An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mattermost — Mattermost Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-18892",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-19T19:15:10.840",
  "references": [
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mattermost.com/security-updates/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. E-mail templates can have a field in which HTML content is not neutralized."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Mattermost Server versiones anteriores a 4.2.0, 4.1.1 y 4.0.5. Las plantillas de correo electrónico pueden tener un campo en el que el contenido HTML no es neutralizado"
    }
  ],
  "lastModified": "2026-06-17T01:13:46.880",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DABD3D9-ABA0-435A-826E-894B85BF330B",
              "versionEndExcluding": "4.0.5"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C98DA462-E8C3-4011-995F-1D813670A5F7",
              "versionEndExcluding": "4.1.1",
              "versionStartIncluding": "4.1.0"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.2.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DBCAAA7B-C893-48F1-B72C-06101B26EA48"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.2.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7103DBD3-7169-4EF7-8354-122E98FBE442"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.2.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C1F4BE86-1DEE-4730-8CC6-64A05A0C85EA"
            },
            {
              "criteria": "cpe:2.3:a:mattermost:mattermost_server:4.2.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B725A0DC-8A41-4788-A705-2EE23EE13009"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}