-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/mattermost/mattermost/server/v8 | go | >= 10.0.0, < 10.0.3 | 10.0.3 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.11.0, < 9.11.5 | 9.11.5 |
| github.com/mattermost/mattermost/server/v8 | go | >= 9.5.0, < 9.5.13 | 9.5.13 |
| github.com/mattermost/mattermost/server/v8 | go | >= 10.1.0, < 10.1.3 | 10.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper type validation of callProps during post processing. Since the attack vector involves specially crafted posts affecting web/mobile clients, the root cause likely exists in post creation/processing handlers. The 'api4.createPost' endpoint is the primary entry point for post submissions, and 'app.PostActionCookie' handles post metadata - both would interact with callProps. Without patch details, this is inferred from Mattermost's architecture and the described vulnerability mechanism.