Launchpad.net

CVE 2017-18920

An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.

See the CVE page on Mitre.org for more details.

References