CVE-2023-1776

Description

Boards in Mattermost allows an attacker to upload a malicious SVG image file as an attachment to a card and share it using a direct link to the file.

How to fix CVE-2023-1776

To remediate CVE-2023-1776, upgrade the affected package to a fixed version below.

• Bitnami/mattermost—upgrade to 7.1.6 or later
• —upgrade to 7.7.2 or later
• —upgrade to 7.1.6 or later
• —upgrade to 7.1.6 or later

Is CVE-2023-1776 being exploited?

Low — EPSS is 0.7%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 7.1.6 | >= 7.7.1, <= 7.7.1
• >= 7.7.0, < 7.7.2
• >= 5.0.0, < 7.1.6
• >= 6.0.0, < 7.1.6

CVSS scores

References (4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-1776
• PATCHgithub.com/mattermost/mattermost-server
• WEBmattermost.com/security-updates
• WEBmattermost.com/security-updates/