{"id":"CVE-2016-11083","published":"2020-06-19T19:29:43Z","modified":"2024-08-06T03:47:34Z","title":"An issue was discovered in Mattermost Server before 2.2.0","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 2.2.0. It allows XSS because it configures files to be opened in a browser window.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0069,"percentile":0.5267,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":10.5,"factors":[{"name":"EPSS percentile","points":10.53}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<2.2.0","<2.2.0+incompatible"],"patched":["2.2.0","2.2.0+incompatible"],"from":["GHSA-rm24-25xm-9454","GO-2025-4065"],"provenance":"source"}],"euvd":{"id":"EUVD-2016-2072","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","children":[{"from":"CVE-2016-11083","to":"CVE-2017-18904","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/file.go"],"commits":["https://github.com/mattermost/mattermost/commit/480308b7029a04cf41d0e9e7cd68b52dc2138e98","https://github.com/mattermost/mattermost/commit/6a2754376c8c8270be5e11e3fdab589659d0cc8d","https://github.com/mattermost/mattermost/commit/bde06a7bc3a03a56da224c1ffcd8bffb0af8071b"],"basis":"rarely changed file"}]},{"from":"CVE-2016-11083","to":"CVE-2017-18915","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["api/file.go"],"commits":["https://github.com/mattermost/mattermost/commit/480308b7029a04cf41d0e9e7cd68b52dc2138e98","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/c7bdce8a6641ed8d361a43b6004a351535c78423"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-11084","published":"2020-06-19","fixed":"2.1.0+incompatible","kev":false,"link":{"from":"CVE-2016-11084","to":"CVE-2016-11083","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"2.1.0+incompatible","toFixed":"2.2.0","daysApart":0}]}},{"cve":"CVE-2016-11081","published":"2020-06-19","fixed":"2.2.0+incompatible","kev":false},{"cve":"CVE-2016-11082","published":"2020-06-19","fixed":"2.2.0+incompatible","kev":false},{"cve":"CVE-2016-11083","published":"2020-06-19","fixed":"2.2.0+incompatible","kev":false},{"cve":"CVE-2016-11073","published":"2020-06-19","fixed":"3.0.0+incompatible","kev":false},{"cve":"CVE-2016-11074","published":"2020-06-19","fixed":"3.0.0+incompatible","kev":false},{"cve":"CVE-2016-11076","published":"2020-06-19","fixed":"3.0.0+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}