{"id":"CVE-2016-11070","published":"2020-06-19T19:25:34Z","modified":"2024-08-06T03:47:34Z","title":"An issue was discovered in Mattermost Server before 3.1.0","vendor":null,"product":null,"tier":"tail","description":{"text":"An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00561,"percentile":0.46595,"provenance":"source"},"cwes":[],"references":[{"url":"https://mattermost.com/security-updates/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":9.3,"factors":[{"name":"EPSS percentile","points":9.32}]},"affected":[{"ecosystem":"Go","package":"github.com/mattermost/mattermost-server","vulnerableRanges":["<3.1.0","<3.1.0+incompatible"],"patched":["3.1.0","3.1.0+incompatible"],"from":["GHSA-h8qw-xqm9-q66j","GO-2025-4050"],"provenance":"source"}],"euvd":{"id":"EUVD-2016-2059","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-mattermost-mattermost-server-cve-2016-11068","children":[{"from":"CVE-2016-11070","to":"CVE-2017-18916","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["model/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/c5deb333db40e4e527f98edb93b41d1b66cfec5f","https://github.com/mattermost/mattermost/commit/0968e4079e0aa670254f3fe3a7248d126e3cf877","https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8"],"basis":"rarely changed file"}]},{"from":"CVE-2016-11070","to":"CVE-2017-18917","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["model/user.go"],"commits":["https://github.com/mattermost/mattermost/commit/c5deb333db40e4e527f98edb93b41d1b66cfec5f","https://github.com/mattermost/mattermost/commit/b74e85653660525d351d090a1e1874ae933bcbc8","https://github.com/mattermost/mattermost/commit/247cd1e51a8c943628dc650e87e794b06aad4c2b"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2016-11079","published":"2020-06-19","fixed":"3.0.0+incompatible","kev":false},{"cve":"CVE-2016-11080","published":"2020-06-19","fixed":"3.0.0+incompatible","kev":false},{"cve":"CVE-2016-11072","published":"2020-06-19","fixed":"3.0.2+incompatible","kev":false,"link":{"from":"CVE-2016-11072","to":"CVE-2016-11070","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.0.2+incompatible","toFixed":"3.1.0","daysApart":0}]}},{"cve":"CVE-2016-11070","published":"2020-06-19","fixed":"3.1.0+incompatible","kev":false},{"cve":"CVE-2016-11071","published":"2020-06-19","fixed":"3.1.0+incompatible","kev":false},{"cve":"CVE-2016-11066","published":"2020-06-19","fixed":"3.1.1","kev":false,"link":{"from":"CVE-2016-11070","to":"CVE-2016-11066","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/mattermost/mattermost-server","fromFixed":"3.1.0+incompatible","toFixed":"3.1.1","daysApart":0}]}},{"cve":"CVE-2016-11067","published":"2020-06-19","fixed":"3.2.0+incompatible","kev":false}],"package":"Go:github.com/mattermost/mattermost-server"}}