CVE-2017-18877: Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server

02 / AFFECTED SOFTWARE

Affected packages

Unknown Unknown

13 explicit affected versions

Go github.com/mattermost/mattermost-server

03 / CONNECTIONS

related SUSE-SU-2025:4395-1

related OPENSUSE-SU-2026:21483-1

04 / EVIDENCE

Open Source Vulnerabilities CVE-2017-18877

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

Open Source Vulnerabilities GO-2025-4190

Mattermost Server is vulnerable to XSS attacks against an OAuth 2.0 allow/deny page in github.com/mattermost/mattermost-server

Open Source Vulnerabilities GHSA-9x8x-w6g5-hx4w

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.

05 / REFERENCES