CVE-2023-35075: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

November 27, 2023 (updated November 28, 2023)

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim’s page by create a channel name that is valid HTML. No XSS is possible though.

References

github.com/advisories/GHSA-jcgv-3pfq-j4hr
mattermost.com/security-updates
nvd.nist.gov/vuln/detail/CVE-2023-35075

Code Behaviors & Features

Detect and mitigate CVE-2023-35075 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →